Excluded or removed tests relying on actual webserver routing

The "sanitychecks" group excludes through phpunit.xml.dist.
Removed RestfulService->testHttpErrorWithoutCache()
since its not sufficiently isolated in terms of testing.
Has been refactored in 3.x, but too intrusive to backport.

Changes mainly necessary to get Travis builds passing,
since we don't want to start mucking around with
dynamically generated file-to-url mappings just to
get *unit* tests passing - as opposed to integration-testing
the whole environment incl. webserver.
API Rename Transliterator to SS_Transliterator to remove conflict with Intl extension
Merge pull request #977 from simonwelsh/rename-Transliterator

API Rename Transliterator to SS_Transliterator to remove conflict with Intl extension
Fixed DateTest timezone settings

Backport from 3.x, see d1a9e2b3 and 0aeda5c9
Support for composer-created themes dir structure

Due to git limitations, we can't check out the blackcandy
"parent" theme into themes/blackcandy/ directly, since that
would require sharing paths with git repositories of other themes.
Fixed HTML syntax in config-form.html
2.4.9 changelog
Copying request params before Core.php exec in PHPUnit bootstrap

Same behaviour as with 3.0 bootstrap.php and the
2.4 cli-script.php (which it is based on).
This allows to use GET switches which are evaluated in _config.php
files, e.g. db=<db-alias> settings for running tests
with various DBs without changing the underlying PHP config.
Update documentation of nginx configuration

- Avoid using "if" to check for file existence (use try_files instead)
- Replicate the behavior of the .htaccess files
- TODO: get static error pages to work
API Require ADMIN for ?showtemplate=1
Merge pull request #1181 from chillu/pulls/showtemplate-admin

API Require ADMIN for ?showtemplate=1 (2.4)
Nginx docs for denying composer file access (fixes #8011)
BUG Undefined `$allowed_actions` overrides parent definitions, stricter handling of $allowed_actions on Extension

Controller (and subclasses) failed to enforce $allowed_action restrictions
on parent classes if a child class didn't have it explicitly defined.

Controllers which are extended with $allowed_actions (through an Extension)
now deny access to methods defined on the controller, unless this class also has them in its own
$allowed_actions definition.
Improved docs on $allowed_actions

Added section to "Controllers" and "Form" topics,
added $allowed_actions definitions to all controller examples
BUGFIX Keep Member.PasswordEncryption setting on empty passwords

This will prevent empty passwords to set the encryption to 'none',
which in turn will store any subsequent password changes in cleartext.
Reproduceable e.g. with ConfirmedPasswordField and setCanBeEmpty(true).
Add ContentController->handleWidget() to $allowed_actions

Required by recent $allowed_actions security fix
Updated changelog
BUG Transaction stub methods for better cross 2.x and 3.x compat

The transactionStart() naming is 3.x, and used by some modules
which are otherwise still 2.x compatible.

Specifically, this was added to avoid branching the payment module
into separate 2.x and 3.x compatible branches.
BUG SQL Injection in CsvBulkLoader (fixes #6227)

Diff should speak for itself, looks like this will have to be implemented in all supported branches. 
Merge pull request #1308 from ss23/patch-10

BUG SQL Injection in CsvBulkLoader (fixes #6227)