Upgrade itsdangerous from 1.1.0 to 2.0.1

This upgrades itsdangerous by a major version.

When testing most routes we:
* use the `client_request` fixture
  * under the hood this logs in the user with `TestClient.login`
  * logging in the user signs their session with a secret and the current time

For some tests we also:
* wrap the test method with a `freeze_time()` decorator to simulate a past date and time

When Pytest calls the wrapped test method:
* any application code which tries to get the current time will get the frozen time
* any application code getting the current user means decoding the session
* the code which decodes the session will see that the session was created in the future, in other words it has a negative age
  * as of ItsDangerous 2.0.0 signatures with a negative age raise an exception

To avoid all the tests which freeze time failing, this adds itsdangerous
to the list of packages that freezegun ignores.

We can't yet upgrade to a version of itsdangerous that is >= 2.1.0
because there are compatibility issues with Flask 1.x.

tests/__init__.py

@@ -3,6 +3,7 @@ from datetime import datetime, timedelta, timezone
 from unittest.mock import patch
 from urllib.parse import parse_qs, urlparse
 
+import freezegun
 import pytest
 from flask import session as flask_session
 from flask import url_for
@@ -11,6 +12,12 @@ from flask_login import login_user
 
 from app.models.user import User
 
+# Add itsdangerous to the libraries which freezegun ignores to avoid errors.
+# In tests where we freeze time, the code in the test function will get the frozen time but the
+# fixtures will be using the current time. This causes itsdangerous to raise an exception - when
+# the session is decoded it appears to be created in the future.
+freezegun.configure(extend_ignore_list=['itsdangerous'])
+
 
 class TestClient(FlaskClient):
     def login(self, user, mocker=None, service=None):