IAS v9: Fully rewrite (for security, modern code, portability)

[VidTu]

What's new:

• Rewritten all code from the ground up using modern Java (17) and modern Minecraft API. (Probably fixed some bugs and added some more due to this)
• Refactored the project to allow easier cross-loader and cross-version development.
• Added access/refresh token encryption with hardware or password key at your choice. (To combat token stealing and accidental token sharing; It's possible to opt-out of token encryption but it's UNSAFE and is disabled in the config by default)
• Added a lot of things to prevent token stealing and accidental token sharing. (Encryption mentioned above; Moved accounts out of config folder; Added disclaimers and "loud" file names into the new folder; Added info on how to "revoke" all tokens)
• Added Forge, NeoForge, and native Quilt support.
• Some authentication errors will now use more detailed/helpful messages.
• Authentication link will be now copied to clipboard.
• Improved security and fixed some bugs for Microsoft authentication. (Also added alternative authentication method lsimilar to MultiMC/Prism)
• Used new skin widgets (used for skin reporting by Mojang) to preview skins.
• Added an option to show nick in the server list. (Enabled by default; Can be disabled)
• Enabled button in the server list by default. (Can be disabled)
• Auto-moving IAS button to the right if there's another mod button in the way. (Server list button example with NoChatReports installed)
• Added a lot of various tooltips.
• Prevent invald offline names (too long, too short, containing invalid characters) by default. (Can be overridden)
• Added toast notification (warning) for invalid offline names when joining a server. (Can be disabled)
• Added an option to show current username in the game title bar. (Disabled by default)
• UI was rewritten. (Main UI is mainly untouched; Account adding/removing/editing/using screens remade into "fluent popups"; Config UI is changed slightly; Keybinds will work in some GUIs; Double clicking an account will use it; Accounts will show tooltips)
• Added a few unexpected pigs.
• Addes some help pages.

Required: (before merging)

• [x] Config screen and ModMenu integration. (Config system is ready) (✅ Config system and screen are both ready)
• [x] Config and accounts migration from IAS8. (✅ Done)
• [x] Support account reordering. (like in IAS8) (✅ Done)
• [x] Ensure that current encryption system is stable and secure to be "baked". (✅ Probably and it should be not too hard to change if we need)

To consider:

• [x] Is the current hardware key generation system unique enough? (Can use OSHI reflectively as it's provided by Mojang sometimes) (✅ Pretty secure now, uses old Java property and env retrievers and when available uses OSHI to retrieve baseboard, BIOS, disks, graphics cards for hardware key)
• [x] Is the current hardware/password key AES/PBKDF2 encryption secure enough? (✅ PBKDF2/Sha512Hmac uses 500_000 iterations, it's stronger than recommended by OWASP; AES/GCM uses 256 bits, 16-byte IV; the only weakness is either choice or implementation details, can use ChaCha-Poly, not sure about support)
• [x] Forge/NeoForge port? (With Architectury Loom) (✅ Done)
• [x] Native Quilt port? (Shouldn't be too hard) (✅ Done)
• [x] Backport to some MC versions with Java 17? (1.18.2, 1.19.2, 1.19.4, 1.20.1, 1.20.2?) (❌ Probably after releasing Release Candidates)
• [x] Using "state" query in MS auth to increase security? (If it will increase security) (✅ Using now)
• [x] Informative error messages for common login errors? (✅ Some errors related to crypting, internet connection and common issues from wiki.vg now have fancy messages with additional help info)
• [x] Username in the titlebar? (✅ Done)
• [x] Displaying (and copying?) account UUID somewhere? (tooltip?) (✅ Done, in tooltip and copying with CTRL+C for name or CTRL+SHIFT+C for UUID)
• [x] Text color configuration? (❌ Not planned for now, color picker will be either really big in code, using tinyfd, which may not be supported for all MC versions, or plain text fields which is inconvenient)
• [x] More convenient button configuration? (e.g. drag-and-drop) (❌ Not planned for now, button automatically moves if it'll overlap with another button, that's enough for simple users, advanced users could use advanced config especially with new helper tooltips)
• [x] CI (GitHub Actions), dependabot, renovate? (For various dependencies and things such as Fabric API, Loom, Gradle) (⚠️ Sort of, requires enabling later)
• [x] Security policy, secret scanning, private vulnerability reporting? (⚠️ Sort of, requires enabling later)
• [x] Gradle upload plugins? (Minotaur, CurseGradle) (❌ They don't work with Architectury Loom, will try GH actions task later)
• [x] Add "security concerns" and "common issues" pages? (also add them into ModMenu and probably account selector or config UI) (✅ Done)
• [x] Add alternate authentication method used, e.g. in MultiMC and Prism Launcher. (✅ Done)
• [x] Add remote (GitHub) endpoint that will disable the (current version of the) mod, if say a security vulnerability is found. (✅ Done)
• [x] Clear clipboard on MS auth end/success/fail/cancel if it contains something that looks like an auth link. (Sharing auth link shouldn't be a security problem anyway) (✅ Done)

Resolves #84. Resolves #92. (By adding descriptive error messages) Resolves #98. (10 ports will be used, they're added manually in the Microsoft Entra, so I'm lazy to do more; Alternate authentication method was also added) Resolves #104. (By also copying the link into the clipboard) Resolves #106. (By adding descriptive error messages) Resolves #113. (By adding descriptive error messages) Resolves #115. (By adding descriptive error messages) Resolves #124. (By using new skin renderer) Resolves #130. (By rewriting UI)

Will close #120. (Deprecated) Will close #128. (Deprecated)

[ghost]

virus steal account

[VidTu]

@The-Fireplace, it should be ready for the first release candidate. Can you give me the access to the CI (GH actions) and security (security policy, etc) settings?

[The-Fireplace]

@VidTu Done. I went ahead and enabled Dependabot security scanning while I was at it, feel free to adjust as needed.

[VidTu]

Thank you. I think I'll do some more testing and will release first release candidate on Modrinth, CurseForge after the weekend. Maybe I'll also set up something like mc-publish as it's recommended by Fabric in the future to automate publishing. (especially during the release candidate phase so it won't screw everything up if it won't release on one platform due to wrong config or something like that)

[VidTu]

@The-Fireplace feel free to review and merge (squashing preferred). After that I'll probably push first "9.0.0-alpha.1" version to Modrinth/CF. (Unless you'll have complaints)

[VidTu]

oops, duel-booting into linux broke system clock and windows didn't sync time for some reason. these 3 commits were added just now, not 3 hours ago.