…ross models, migrations, business, REST, schemas, hooks, celery tasks, tests

…NOT NULL crash

- custom_dashboard.owner_id had no ON DELETE rule, so deleting a
  dashboard's owner raised a raw ForeignKeyViolation/500 instead of
  orphaning the (possibly shared) dashboard. Set ondelete='SET NULL'.
- AuthorizationGroupSchema.group_permissions had no load_default, so
  full loads (e.g. group creation) with the key omitted hit a NOT NULL
  violation. Add load_default=0.

flask-cors, SQLAlchemy, alembic, cryptography, pyotp, bleach had
drifted to slightly older patch versions than the parallel
dependency-update work on the upstream PR branch.

… table fixes)

Merging the 3 new upstream commits re-forked the alembic head
(dashboard_owner_fk vs collab_doc_seeder_version) - add the merge
migration to resolve it.

Also document a disposable iris-test podman stack for running the
test suite without touching real dev-stack data/volumes.