Odd/non-intuitive behaviours in Formio

[sergei-maertens]

... for which we need to apply patches in the backend validation since we can't easily patch up Formio. We should really revisit these once we sort out the new renderer/builder.

To find backend code, search commits related to #4068, #4065, ???

• No input validation is performed whatsoever on hidden (static or conditionally) components. When I define a component with certain constraints, I expect guarantees that the data will always conform to those constraints. E.g. this possibly allows sending bogus data for email address components if they are hidden.
• Date components send their empty value as "" rather than null.
• (not verified yet) Datetime components send their empty value as "" rather than null.
• (not verified yet) Time components send their empty value as "" rather than null.
• Textfield (and derived, like email, postcode, bsn...) components get a defaultValue: null or defaultValue: [null] with multiple enabled, rather than defaultValue: "" or defaultValue: [""]
• There are still layout components around in environments with validate and/or validate.required: True (like fieldset). Those should be fixed with a data migration + a fixup for form imports (I suspect that's how they survive)
• Even when providing explicit default values in the form builder for component configurations, Formio can override them (e.g. if defaultValue is set to '', formio can override this to null).
• select component with multiple: true results in a defaultValue: [""]. Validation now allows this, but it shouldn't once #4084 is fixed