[TASK] Add packageKey attribute to ifHasRole view helper

This change adds support for handling a packageKey to the ifHasRole
view helper. It can be used in three ways:

1) The 'old' way, with just a string like 'Administrator'
   This will result in a check for the Administrator role within
   the current package (fetched from the controllerContext)
2) With a full role identifier like 'Foo.MyPackage:Administrator'
3) Using both, the role attribute and packageKey attribute

This was once Iae92119bf9f8d6125211d1e4b1e42a0a513d804b but had to be
reverted after an accidental merge.

Change-Id: If4c762c5de51c747495a3602eb56c56dd3972c73
Related: #37451
Releases: 2.0, master
[!!!][TASK] CSRF protection for "safe" request methods

This change set adjusts URL related view helpers in Fluid to
an important behavior for Flow applications: HTTP request
methods which are, by definition, considered to be "safe"
(that is, "read-only") are now treated as such.

The Fluid Link and Uri view helpers will not generate CSRF tokens
anymore, since we assume that you are using them for GET requests.
The FormViewHelper however, will enable link protection if the
form does not have method="get" set.

Please adjust your applications to cleanly observe this principle since
more optimizations in this direction are planned for later versions of
TYPO3 Flow.

Related: #47252
Releases: 2.0, master
Change-Id: Ic600a9e591d047ca9bbd39d352c4f337bcfaa6a9
[FEATURE] CSRF token ViewHelper

With I9d667aa451a7510cf12ab13be745fed1f7ca477e CSRF tokens
are not added to URIs any longer.
Therefore you need to add the token yourself for "unsafe" requests
(POST, PUT, DELETE, ...).

This is not true for fluid forms where the token is added automatically
if the form does not have method="get" set
(see Ic600a9e591d047ca9bbd39d352c4f337bcfaa6a9).

For other forms or AJAX requests the ViewHelper can be used like this:

<form action="<someAction>" method="post">
  ...
  <input type="hidden" name="__csrfToken" value="{f:security.csrfToken()}" />
</form>

Change-Id: I519c5ca522fede984bb93809a942b40a85008466
Related: #47252
Releases: 2.0, master
Merge remote-tracking branch 'upstream/master'