When validating tokens, the dummyUser created at the beginning is set
with validated=true. This means there won't be the state change that used
to occur from validated:false to validated:true (which detects the moment
joined the meeting) , therefore the alert code that expects for this change
won't run.
To fix this for audio alerts, we now detect when user join by observing
additions in Users's collection. This is actually good because we start
observing this only once (in componentDidMount), differently we used to do,
by calling this every time the tracker was activated.

To distinguish between the user addition that initially populates user's
collection from those that happens after user join (which are the ones we
want), we store the initial state (at componentDidMount) and compare it
with new additions. If the user added is present at the initial state,
then it is an addition to populates the collection, otherwise this is a real
user addition (happened after user joined the meeting)

Partially fixes #11399

Backport audio improvements from 2.3

Without 'exact' match, the browser fallbacks to the default inputDeviceId

This prevents the error (input device error)  when breakout is ended and we try
to skipCheck the microphone when user returns to main room (assuming the
user had the microphone active before joining breakout room).

Prevent toggleMute api call to be called for listenonly
This has no effect to the end user, but avoids unnecessary server calls

Fixes #11490

Fixes #11489

Bump to 2.2.35

Fix padId getter

Pad exporter uses this same location to serve pad's downloaded content
but the the match was failing because padId is not the last element
of the URL on that scenario.

Pattern follows /pad/p/<padID>[/export/(format)]?<query>.

Improve permission checks for video, screen sharing and listen only

Update handleClick condition (fix text-area for FireFox)

Rework padIds and turn bbb-web pad aware

Bump to 2.2.33

Set falllback value of voiceConf.ejectRogueVoiceUsers to true

Disable customHeartbeat 10826

Clean up HTMLAudioElement used for notification sounds

After ending the notification playback, we set the ".src" property to null, which immediately stop the internal player of mobile browser (tested on Chrome for Android -  device list is on #11458).
For the specific list of devices, this prevents the internal buffer error "-61" described in #11458.
Fixes #11458.

Enable video-pagination and cameraQualityThresholds by default

Option to eject voice users with no matching user (re-submit #10959)

The lack of handling to check whether the user was a dial-in user when answering akka-apps periodic member probes was making it use an arbitrary default (callerName) as the userId, explicitly violating the convention that dial-in/outs should have v_memberId userIds

That would botch whichever added janitorial tasks that operated upon akka-apps GetUsersStatusToVoiceConfSysMsg probes

To be used with the ejectRogueVoiceUsers config option

Reconnects may introduce ghost voice users in a meeting when the client fails to
rejoin but the audio connection remains active.

While fetching for the voice conference user's status, apps can now check if a
voice user has a matching user record. If it doesn't, eject the voice user.

Preserve mutestatus when disconnecting/reconnecting microphone

After audio reconnection, a muted user would have it's microphone unmuted by default, unless muteOnStart is set to true. This fix this problem.
Fixes #9016

Used by bbb-webrtc-sfu to enrich its validation on whether a user is allowed to broadcast or subscribe to a camera stream

Used by bbb-webrtc-sfu to enrich its validation on whether a user is allowed to broadcast a screen or subscribe to one

Used by bbb-webrtc-sfu to enrich its validation on whether a user is allowed to subscribe to the global audio bridge via listen only or not

Associate pads with meetings so session validation is restricted to the
meeting's valid session tokens.

Meteor will dispatch new redis events on shared notes and closed captions
pads creation. This event will go through apps and reach web to populate
a new meeting's pad collection that contains all valid pad id's for that
session. Nginx will use this collection to check if the user's session token
belongs to the pad's authorized users.

Besides these modifications, an extra change will be needed at notes.nginx.
Location /pad/p/ needs to change it's auth_request:

from /bigbluebutton/connection/checkAuthorization;
to /bigbluebutton/connection/validatePad;

Make sure checksum validation is done first in join API and display an error without redirection in failure case

Don't validate insecure http urls for external video to prevent browser errors