FIX Only block root vendor folder

Use RewriteRule instead to take in account any subfolder via RewriteBase. Deny ss-cache and composer via RewriteRule too.
BUG GridFieldFilterHeader works without non-filterable cols

Previously relied on the presence of a last column which wasn't filterable,
commonly a GridFieldEditButton. If this wasn't present, the filter buttons
were never added, leading to the GridField JS reload request being sent
without the required button form action, so GridFieldFilterHeader->handleAction()
was never called.
Update server-requirements.md
Update common-problems.md
Update common-problems.md
Update common-problems.md
Merge pull request #1982 from chillu/pulls/gridfield-filter-cols

BUG GridFieldFilterHeader works without non-filterable cols
Merge pull request #1786 from colymba/3.0-htaccess-fix

vendor folder is blocked only if outside themes
BUG: fixed "regression" inserted with 9281ebc64764a58f86f685f9765e1d8b60995e5a adding a new class to SiteTree elem (edit-disabled)
FIX: Make session timeout inactive-time only.

By default, the Session.timeout configuration option specifies the total
session time, regardless of the amount of activity.  This change means
that the timeout specifies how long without any further dynamic requests
before the session cookie expires.

The way it does this is to re-set the session cookie expiry with a
subsequent Set-Cookie command each time a request that necessitates
a session is called.

Strictly speaking, it's a change in session timeout semantics, but I think
it's a good one, because total-session-time-regardless-of-activity is a
stupid timeout to include, and has more to do with the mechanics of the
internet than with application security requirements.
NEW: Add LeftAndMain.session_keepalive_ping config option.

The Session-keepalive ping that is built into LeftAndMain (i.e. all of the CMS admin) can now be
turned off.  The main reason you would want to do this is if you have enabled Session.timeout,
and you want users to be locked out of the CMS after a period.
Merge pull request #2040 from sminnee/session-timeout-fixes

Session timeout fixes
FIX Deprecation $manifest not in global scope

$manifest is not in the global scope, patched it to use SS_ClassLoader to get the manifest instead.
Merge remote-tracking branch 'origin/3.0' into 3.1
FIX make augmentSQL API consistent for strict PHP

This references silverstripe/silverstripe-translatable#113
For that issue, we needed to have the DataQuery as the second parameter to
DataQuery's augmentSQL call.  Fortunately, DataQuery was already passing this
argument.  However, where the function was defined in DataExtension, the
argument was not present.  Thus, subclasses of DataExtension could not add the
parameter to their function signature if they were running in PHP strict mode
because PHP will complain that the signatures don't match.
Merge pull request #2042 from jthomerson/fix_augment_sql_api

FIX make augmentSQL API consistent for strict PHP
NEW: Add Thumbnails to 'Choose another file' dialogue

Very difficult to choose an image based on file name alone. Added thumbnail and reduced rows from 10 to 8 to compensate for increased height of rows with thumbnail included.
Updating FileTest to use the correct shortcode format with commas
Revert "FIX make augmentSQL API consistent for strict PHP"

This reverts commit ab40dcc0ca118a782b95491eacd927a6f6f8c092.
FIX extra_requirements to accept non associative arrays.

Added unit tests for extra_requirements_js and extra_requirements_css.

Fixed YAML documentation to indicate list syntax.