[daniel-slaugh]

#570

Fixes 3 issues flagged in my v2.0 testing Google doc:

1. PATCH UPDATES - Updating one task variable can silently delete unchanged variables: The problem was Tasks didn't use the same convention as tags. Updated the API and both clients to conform to the JSON Merge Patch standard so patching resources works consistently.
2. ORCHESTRATION - Existing data connections cannot be saved through the app: lookback windows weren't being handled correctly causing data connection edits to fail.
3. TS CLIENT - can send HydroServer bearer tokens to external rating-curve hosts: Problem was some rating-curve hosts were being sent requests directly. This was dead code so I removed it. Now the TS client exclusively makes requests to its declared HydroServer.

I was planning on grouping more of my testing bug fixes in this PR, but these are pretty big changes, so I'll group these 3 together so the review is more manageable and put the rest in followup PRs.

[kjlippold]

Changes to orchestration and the TS client look good.

For the merge-patch implementation, I'd suggest dropping the Accept-Patch header from PATCH responses unless one of our clients needs it. RFC 5789 puts it in OPTIONS responses, which is also how the OGC API Features Part 4 draft declares PATCH support. I have OPTIONS planned for v2.1, so the header could move there, or I can move it up to v2.0 if we need it now.

PATCH endpoints now apply merge-patch and the OpenAPI spec only lists application/merge-patch+json, but application/json is still accepted rather than rejected with a 415. Probably not a big deal, but if we're not going to reject application/json, we should probably list it in the spec too.

One other issue found in the review; in hydroserverpy, TaskService.update(task_variables=None) is silently dropped rather than sent, so it does nothing without raising an error. Suggest sending None through so the server rejects it with a 400 like it does with tags.