[1.5.x] Bump version post-release.
[1.5.x] Documentation -- Improved description of cache arguments

- Fixed some grammar and formatting mistakes
- Added the type and default for CULL_FREQUENCY
- Made the note on culling the entire cache more precise. (It's actually
  slower on the filesystem backend.)

Backport of 5eca021d48 from master
[1.5.x] Fixed #20887 -- Added a warning to GzipMiddleware in light of BREACH.

Thanks EvilDMP for the report and Russell Keith-Magee
for the draft text.

Backport of da843e7dba from master
[1.5.x] Documentation -- added instructions on working with pull requests

Since non-core contributors are asked to review patches, instructions
on working with pull requests were added to the Working with Git and
GitHub page (based on the existing instructions in the core
committers page).

Backport of 990ce9aab9 from master
[1.5.x] Fixed #21094 -- Updated reuseable apps tutorial to use pip for installation.

Thanks ylb415 at gmail.com for the suggestion.

Backport of e4aab1bb8d from master
[1.5.x] Fixed #18923 -- Corrected usage of sensitive_post_parameters in contrib.auth

Thanks Collin Anderson for the report.

Backport of 425d076d0c from master
[1.5.x] Fixed #21101 -- Updated urlize documentation to mention email addresses

Backport of 39b49fd339 from master
Fixed #21102 -- pickling a QuerySet with prefetches twice

Fixed the bug that a QuerySet that prefetches related objects cannot be
pickled and unpickled more than once (The second pickling attempt
raises an exception).

Added a new test for the queryset pickling idempotency.

The bug was introduced by
bac187c0d8e829fb3ca2ca82965eabbcbcb6ddd5.
[1.5.x] Ensure that passwords are never long enough for a DoS.

 * Limit the password length to 4096 bytes
  * Password hashers will raise a ValueError
  * django.contrib.auth forms will fail validation
 * Document in release notes that this is a backwards incompatible change

Thanks to Josh Wright for the report, and Donald Stufft for the patch.

This is a security fix; disclosure to follow shortly.

Backport of aae5a96d5754ad34e48b7f673ef2411a3bbc1015 from master.
[1.5.x] Add release notes and bump version numbers for 1.5.4 security release.