BUG Transaction stub methods for better cross 2.x and 3.x compat

The transactionStart() naming is 3.x, and used by some modules
which are otherwise still 2.x compatible.

Specifically, this was added to avoid branching the payment module
into separate 2.x and 3.x compatible branches.
BUG SQL Injection in CsvBulkLoader (fixes #6227)

Diff should speak for itself, looks like this will have to be implemented in all supported branches. 
Merge pull request #1308 from ss23/patch-10

BUG SQL Injection in CsvBulkLoader (fixes #6227)
Simplified travis builds (external setup scripts)
Require cms in 2.4 composer.json (which is used in travis)
Less trademark-encumbered doc icons (fixed #1787)

Thanks to http://p.yusukekamiyamane.com/
Use the correct variable as the key into $record

It was using $fieldName, which is the CSV field name, not the database
field name. This prevents duplicate detection from working. It now
properly uses $SQL_fieldName
Merge pull request #1821 from oddnoc/csvbulkloader-findexisting-2.4

Use the correct variable as the key into $record
composer/installer dep workaround

Moved to end of requirements, to work around a bug in composer - see https://github.com/composer/composer/issues/1147. This caused the dependencies to be installed in the wrong folder because the custom 'silverstripe-module' instructions hadn't been loaded at the time the core modules were installed via composer.
Fixing array to string conversion in dev/build for PHP 5.4
Updated github path
Move getTempFolder out of Core.php to own file
FIX Prevent DOS by checking for env and admin on ?flush=1 (#1692)
Merge pull request #2246 from hafriedlander/fix/flush_24

 FIX Prevent DOS by checking for env and admin on ?flush=1 (#1692) in 2.4
FIX: Have ParameterConfirmationToken includes work regardless of include path
FIX: Ignore invalid tokens instead of throwing 403
FIX: Actually use argument in getTempFolder
Merge pull request #2247 from hafriedlander/fix/flush_24

FIX: Have ParameterConfirmationToken work regardless of include path
FIX: Fixed TempPath inclusion for phpunit & cli-script
Split Core.php into Constants.php and Core.php and adjust main.php startup

The recent flush filter fix had a problem that you couldnt set a custom
BASE_PATH in _ss_environment because that file didnt get included until
after checking the confirmation token. This patch pulls the part of Core.php
that defines BASE_PATH into a seperate file that can be included earlier
in the startup sequence so that ParameterConfirmationToken can access it.

Core.php includes Constants.php with a require_once call, so for startup
scripts that dont pull in Constants.php themselves (like cli-script.php)
no change is needed.