[FrameworkBundle] The config:dump-reference command shows the list of bundles with the table helper
[Form] check the required output timezone against the actual timezone
of the input datetime object, rather than the expected timezone supplied
Added doc comments
[HttpFoundation] Header `HTTP_X_FORWARDED_PROTO` can contain various values
Some proxies use `ssl` instead of `https`, as well as Lighttpd mod_proxy allows
value chaining (`https, http`, where `https` is always first when request is encrypted).
[Routing] removed extra argument
[DependencyInjection] Prevented inlining of lazy loaded private service definitions.
[Security] Added CSRF sub-component
[Security] Changed Security HTTP sub-component to depend on CSRF sub-component instead of Form
[Form] Deprecated the CSRF implementation and added an optional dependency to the Security CSRF sub-component instead
[FrameworkBundle][SecurityBundle] Added service configuration for the new Security CSRF sub-component
minor#8823 [Security] [2.2] Added doc comments and missing use statement (piotrantosik)

This PR was merged into the 2.2 branch.

Discussion
----------

[Security] [2.2] Added doc comments and missing use statement

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Commits
-------

7ee39a6 Added doc comments
bug#9103 [HttpFoundation] Header `HTTP_X_FORWARDED_PROTO` can contain various values (stloyd)

This PR was merged into the 2.2 branch.

Discussion
----------

[HttpFoundation] Header `HTTP_X_FORWARDED_PROTO` can contain various values

Header `HTTP_X_FORWARDED_PROTO` can contain various values. Some proxies use `ssl` instead of `https`, as well as Lighttpd mod_proxy allows value chaining (`https, http`, where `https` is always first when request is encrypted).

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Tests pass?   | yes
| Fixed tickets | #9101
| License       | MIT

Commits
-------

d997443 [HttpFoundation] Header `HTTP_X_FORWARDED_PROTO` can contain various values Some proxies use `ssl` instead of `https`, as well as Lighttpd mod_proxy allows value chaining (`https, http`, where `https` is always first when request is encrypted).
[Security] fixed wrong phpdoc
bug#9153 [DependencyInjection] Prevented inlining of lazy loaded private service definitions (jakzal)

This PR was merged into the 2.3 branch.

Discussion
----------

[DependencyInjection] Prevented inlining of lazy loaded private service definitions

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #9136
| License       | MIT
| Doc PR       |

Commits
-------

bb0125b [DependencyInjection] Prevented inlining of lazy loaded private service definitions.
Fix problem with Windows file links (backslash in JavaScript string)
bug#9154 Fix problem with Windows file links (backslash in JavaScript string) (fabpot)

This PR was submitted for the master branch but it was merged into the 2.2 branch instead (closes #9154).

Discussion
----------

Fix problem with Windows file links (backslash in JavaScript string)

This PR was submitted on the symfony/WebProfilerBundle read-only repository and moved automatically to the main Symfony repository (closes symfony/WebProfilerBundle#5).

When you have set php.ini setting xdebug.file_link_format, under Windows this window.location call here isn't escaped properly, so it results in something like:

```HTML
<span class="sf-toolbar-info-method" onclick="window.location='pstorm://open/?url=file://F:\HtDocs\myproject\src\Foo\Core\Controller\PageController.php&amp;line=28';window.event.stopPropagation();return false;">
    pageAction
</span>
```

All backslashes in window.location are treated as escape sequences witch result in an incorrect link:
pstorm://open/?url=file://F:HtDocsmyprojectsrcFooCoreControllerPageController.php&line=28

So clicking this link my IDE (phpStorm) couldn't find that file.

The patch fixes this by escaping the backslashes.

Commits
-------

03c6027 Fix problem with Windows file links (backslash in JavaScript string)
[HttpKernel] added missing argument to listener call
bug#9166 [HttpKernel] added missing argument to listener call (fabpot)

This PR was merged into the master branch.

Discussion
----------

[HttpKernel] added missing argument to listener call

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | na
| License       | MIT
| Doc PR        | n/a

When calling a listener, the dispatcher now must pass the event name and the dispatcher (see 7852), but the traceable event dispatcher did not do that.

Commits
-------

e26ae45 [HttpKernel] added missing argument to listener call
fixed a typo
fixed Client when using the terminable event