FIX Only block root vendor folder

Use RewriteRule instead to take in account any subfolder via RewriteBase. Deny ss-cache and composer via RewriteRule too.
BUG GridFieldFilterHeader works without non-filterable cols

Previously relied on the presence of a last column which wasn't filterable,
commonly a GridFieldEditButton. If this wasn't present, the filter buttons
were never added, leading to the GridField JS reload request being sent
without the required button form action, so GridFieldFilterHeader->handleAction()
was never called.
Update server-requirements.md
Update common-problems.md
Update common-problems.md
Update common-problems.md
Merge pull request #1982 from chillu/pulls/gridfield-filter-cols

BUG GridFieldFilterHeader works without non-filterable cols
Merge pull request #1786 from colymba/3.0-htaccess-fix

vendor folder is blocked only if outside themes
BUGFIX: Removed regression introduced in 9741d1. With the former in place, CMS authors can no longer perform batch publish actions
Merge pull request #2032 from phptek/bug/revert-9741d1

BUGFIX: Removed regression introduced in 9741d1.
NEW: More helpful message for 'sake dev/build' on new envs.

This change alters the no-db message on cli execution to give a bit more of a helpful set-up instruction.
The main motivation for this is so that composer can be set to run dev/build on post-install and post-update.

With that feature added, this will ensure that users installing with composer create-project won't be left
in the dark.

An improvement on this would be a shell script that interactively asked for details to populate this file
with, but one step at a time.
Merge pull request #2033 from sminnee/better-no-db-error

NEW: More helpful message for 'sake dev/build' on new envs.
FIX: Convert newlines to <br /> tags in string fields (fixes #1942)
Merge pull request #2034 from kinglozzer/1942-stringfield-newlines

FIX: Convert newlines to <br /> tags in string fields (fixes #1942)
BUG: fixed "regression" inserted with 9281ebc64764a58f86f685f9765e1d8b60995e5a adding a new class to SiteTree elem (edit-disabled)
FIX: Make session timeout inactive-time only.

By default, the Session.timeout configuration option specifies the total
session time, regardless of the amount of activity.  This change means
that the timeout specifies how long without any further dynamic requests
before the session cookie expires.

The way it does this is to re-set the session cookie expiry with a
subsequent Set-Cookie command each time a request that necessitates
a session is called.

Strictly speaking, it's a change in session timeout semantics, but I think
it's a good one, because total-session-time-regardless-of-activity is a
stupid timeout to include, and has more to do with the mechanics of the
internet than with application security requirements.
NEW: Add LeftAndMain.session_keepalive_ping config option.

The Session-keepalive ping that is built into LeftAndMain (i.e. all of the CMS admin) can now be
turned off.  The main reason you would want to do this is if you have enabled Session.timeout,
and you want users to be locked out of the CMS after a period.
Merge pull request #2040 from sminnee/session-timeout-fixes

Session timeout fixes
FIX Deprecation $manifest not in global scope

$manifest is not in the global scope, patched it to use SS_ClassLoader to get the manifest instead.
Merge remote-tracking branch 'origin/3.0' into 3.1