CSRF warning docs on Request::enableHttpMethodParameterOverride()

[HttpFoundation] fixed the docs so that it gives some explanation about how you are vulnerable to CSRF when you enable the httpMethodeParameterOverride
[Form] fix form handling with unconventional request methods like OPTIONS
[Config] fix filelocator with empty name
[DependencyInjection] use inheritdoc for loaders
[Validator] Fixed Regex::getHtmlPattern() to work with complex and negated patterns
[Routing] serialize the compiled route to speed things up

This also makes the CompiledRoute implement Serializable in order to:
1. make the serialization format shorter
2. have no null bytes in there, which the native serializer add for private properties, and thus would complicate saving in databases etc.
3. We should add to our symfony BC promise, that only classes that implement Serializable are ensured to be deserializable correctly with serialized representations of the class in previous symfony versions.
bug #12329 [Routing] serialize the compiled route to speed things up (Tobion)

This PR was merged into the 2.3 branch.

Discussion
----------

[Routing] serialize the compiled route to speed things up

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | not really
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #12012, #12220
| License       | MIT
| Doc PR        | -

This also makes the CompiledRoute implement Serializable in order to:

1. make the serialization format shorter
2. have no null bytes in there, which the native serializer add for private properties, and thus would complicate saving in databases etc.
3.  Since the Route now includes the CompiledRoute in the serialization, the CompiledRoute serialization must be consistent as well. We can only ensure that in future symfony version by implementing Serializable.

We should add to our symfony BC promise, that only classes that implement Serializable are ensured to be deserializable correctly with serialized representations of the class in previous symfony versions.

Commits
-------

fd88de7 [Routing] serialize the compiled route to speed things up
[Kernel] ensure session is saved before sending response
[Session] remove invalid workaround in session regenerate

The original issue #7380 was just caused because the developer missed to save the session before doing the redirect. That's all. This reverts #8270 and following.
minor #12206 [Config] fix filelocator with empty name (Tobion)

This PR was merged into the 2.3 branch.

Discussion
----------

[Config] fix filelocator with empty name

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

fix filelocator with empty name + phpdoc in config component

Commits
-------

63b8c07 [DependencyInjection] use inheritdoc for loaders
ddd2fe2 [Config] fix filelocator with empty name
improve error message for multiple documents

The YAML parser doesn't support multiple documents. This pull requests
improves the error message when the parser detects multiple YAML
documents.
[HttpFoundation] Minor spelling fix in PHPDocs
minor #12374 [HttpFoundation] Minor spelling fix in PHPDocs (GeertDD)

This PR was submitted for the master branch but it was merged into the 2.3 branch instead (closes #12374).

Discussion
----------

[HttpFoundation] Minor spelling fix in PHPDocs

| Q             | A
| ------------- | ---
| Fixed tickets |
| License       | MIT

Commits
-------

35791fd [HttpFoundation] Minor spelling fix in PHPDocs
[ClassLoader] Cast $useIncludePath property to boolean
minor #12371 [ClassLoader] Cast $useIncludePath property to boolean (GeertDD)

This PR was submitted for the master branch but it was merged into the 2.3 branch instead (closes #12371).

Discussion
----------

[ClassLoader] Cast $useIncludePath property to boolean

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

Commits
-------

32001a4 [ClassLoader] Cast $useIncludePath property to boolean
bug #12341 [Kernel] ensure session is saved before sending response (Tobion)

This PR was merged into the 2.3 branch.

Discussion
----------

[Kernel] ensure session is saved before sending response

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #6417, #7885
| License       | MIT
| Doc PR        | n/a

Saves the session, in case it is still open, before sending the response.

This ensures several things in case the developer did not save the session explicitly:

- If a session save handler without locking is used, it ensures the data is available
on the next request, e.g. after a redirect. PHPs auto-save at script end via
session_register_shutdown is executed after fastcgi_finish_request. So in this case
the data could be missing the next request because it might not be saved the moment
the new request is processed.

- A locking save handler (e.g. the native 'files') circumvents concurrency problems like
the one above. By saving the session before long-running things in the terminate event,
we ensure the session is not blocked longer than needed.

- When regenerating the session ID no locking is involved in PHPs session design. See
https://bugs.php.net/bug.php?id=61470 for a discussion. So in this case, the session must
be saved anyway before sending the headers with the new session ID. Otherwise session
data could get lost again for concurrent requests with the new ID. One result could be
that you get logged out after just logging in.

This listener should be executed as one of the last listeners, so that previous listeners
can still operate on the open session. This prevents the overhead of restarting it.
Listeners after closing the session can still work with the session as usual because
 Symfonys session implementation starts the session on demand. So writing to it after
it is saved will just restart it.

Commits
-------

b7bfef0 [Kernel] ensure session is saved before sending response
bug #12326 [Session] remove invalid hack in session regenerate (Tobion)

This PR was merged into the 2.3 branch.

Discussion
----------

[Session] remove invalid hack in session regenerate

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

The original issue #7380 was just caused because the developer missed to save the session before doing the redirect. That's all. Such mistakes won't happen anymore with #12341

This reverts #8270 and following. Also it makes absolutely no sense to do this only for the `files` save handler which creates huge inconsistencies. All save handlers are affected and it's more a documentation thing.

Commits
-------

703d906 [Session] remove invalid workaround in session regenerate
bug #12235 [Validator] Fixed Regex::getHtmlPattern() to work with complex and negated patterns (webmozart)

This PR was merged into the 2.3 branch.

Discussion
----------

[Validator] Fixed Regex::getHtmlPattern() to work with complex and negated patterns

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #5307
| License       | MIT
| Doc PR        | -

According to my own testing, this should fix the generation of HTML patterns when `Regex::$match` is set to false. Additionally, patterns containing pipes (or statements) are fixed. See the test cases for examples.

Commits
-------

bf006f5 [Validator] Fixed Regex::getHtmlPattern() to work with complex and negated patterns
Indicate which file was being parsed if an exception is thrown while running translation:debug

When running the translation:debug command, if a template contains invalid twig markup,
an exception is thrown. This patch rethrows a new exception that includes the filename
being parsed in the message to aid debuging.
[TwigBundle] added a test