Description

Basic problem is that tool workflow versions are eagerly loaded whereas workflow workflow versions are properly lazily loaded.

See
https://github.com/dockstore/dockstore/blob/1.17.1/dockstore-webservice/src/main/java/io/dockstore/webservice/core/Tool.java#L168
vs
https://github.com/dockstore/dockstore/blob/1.17.1/dockstore-webservice/src/main/java/io/dockstore/webservice/core/Workflow.java#L159

However, https://github.com/dockstore/dockstore/blob/1.17.1/dockstore-webservice/src/main/java/io/dockstore/webservice/core/User.java#L159 essentially cycles through both tools and workflows, which is why the starred tools, starred workflows, and starred notebooks all have roughly the same runtime, more noticeable in aws, despite returning much different results.

An initial idea was to lazy load the tools first, but it breaks too much to just optimize for a bit of an edge case. The smaller optimization is to load only tools for starred tools, only workflows for starred workflows, etc. via JPA.
This could be combined with making tool versions actually lazy later (i.e. not an either/or)

Review Instructions
Load up a recent DB, timings between JPA queries and original should be similar to the following

original

with queries

Issue
https://ucsc-cgl.atlassian.net/browse/SEAB-7204

Security and Privacy

None

• Security and Privacy assessed

e.g. Does this change...

• Any user data we collect, or data location?
• Access control, authentication or authorization?
• Encryption features?

Please make sure that you've checked the following before submitting your pull request. Thanks!

• Check that you pass the basic style checks and unit tests by running mvn clean install
• Ensure that the PR targets the correct branch. Check the milestone or fix version of the ticket.
• Follow the existing JPA patterns for queries, using named parameters, to avoid SQL injection
• If you are changing dependencies, check the Snyk status check or the dashboard to ensure you are not introducing new high/critical vulnerabilities
• Assume that inputs to the API can be malicious, and sanitize and/or check for Denial of Service type values, e.g., massive sizes
• Do not serve user-uploaded binary images through the Dockstore API
• Ensure that endpoints that only allow privileged access enforce that with the @RolesAllowed annotation
• Do not create cookies, although this may change in the future
• If this PR is for a user-facing feature, create and link a documentation ticket for this feature (usually in the same milestone as the linked issue). Style points if you create a documentation PR directly and link that instead.