Backports

Candidates for backporting to existing releases:

1.2.x 1.3.x issue
✓ 1.2.1 ✓ 1.3.0 #14345 keep-web lock/unlock/move compatibility
? ? #11419#note-13 cwl-runner fix (input files should be copied in binary mode)
? ? #14538 keep-web+crunch-run - do not block writes while flushing blocks to Keep
N/A ✓ 1.3.1 #14593 arvados-cwl-runner 1.3.0 broken on crunch1
N/A ✓ 1.3.1 #14770 registered workflows fail to run due to spurious --collection-keep-cache=256
? ✓ 1.3.1 #14799 upgrade sso-provider omniauth gem to survive Google+ shutdown
? ✓ 1.3.1 #14826 Search CentOS certificates path when making callbacks to remote clusters
? 1.3.2 #14860 Cannot modify collection when versioning is enabled and idle time is expired