CSRF warning docs on Request::enableHttpMethodParameterOverride()

[HttpFoundation] fixed the docs so that it gives some explanation about how you are vulnerable to CSRF when you enable the httpMethodeParameterOverride
[Form] fix form handling with unconventional request methods like OPTIONS
[Config] fix filelocator with empty name
[DependencyInjection] use inheritdoc for loaders
[Validator] Fixed Regex::getHtmlPattern() to work with complex and negated patterns
[Form] Fixed usage of "name" variable in form_start block
bug #12291 [Form] Fixed usage of "name" variable in form_start block (webmozart)

This PR was merged into the 2.5 branch.

Discussion
----------

[Form] Fixed usage of "name" variable in form_start block

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #10192
| License       | MIT
| Doc PR        | -

Commits
-------

5839832 [Form] Fixed usage of "name" variable in form_start block
[Routing] serialize the compiled route to speed things up

This also makes the CompiledRoute implement Serializable in order to:
1. make the serialization format shorter
2. have no null bytes in there, which the native serializer add for private properties, and thus would complicate saving in databases etc.
3. We should add to our symfony BC promise, that only classes that implement Serializable are ensured to be deserializable correctly with serialized representations of the class in previous symfony versions.
bug #12329 [Routing] serialize the compiled route to speed things up (Tobion)

This PR was merged into the 2.3 branch.

Discussion
----------

[Routing] serialize the compiled route to speed things up

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | not really
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #12012, #12220
| License       | MIT
| Doc PR        | -

This also makes the CompiledRoute implement Serializable in order to:

1. make the serialization format shorter
2. have no null bytes in there, which the native serializer add for private properties, and thus would complicate saving in databases etc.
3.  Since the Route now includes the CompiledRoute in the serialization, the CompiledRoute serialization must be consistent as well. We can only ensure that in future symfony version by implementing Serializable.

We should add to our symfony BC promise, that only classes that implement Serializable are ensured to be deserializable correctly with serialized representations of the class in previous symfony versions.

Commits
-------

fd88de7 [Routing] serialize the compiled route to speed things up
[Kernel] ensure session is saved before sending response
[Session] remove invalid workaround in session regenerate

The original issue #7380 was just caused because the developer missed to save the session before doing the redirect. That's all. This reverts #8270 and following.
minor #12206 [Config] fix filelocator with empty name (Tobion)

This PR was merged into the 2.3 branch.

Discussion
----------

[Config] fix filelocator with empty name

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

fix filelocator with empty name + phpdoc in config component

Commits
-------

63b8c07 [DependencyInjection] use inheritdoc for loaders
ddd2fe2 [Config] fix filelocator with empty name
Remove aligned '=>' and '='
minor #12362 [2.5] Remove aligned '=>' and '=' (disquedur)

This PR was merged into the 2.5 branch.

Discussion
----------

[2.5] Remove aligned '=>' and '='

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | [https://github.com/symfony/symfony/issues/12284]
| License       | MIT

PR for 2.3 branch : https://github.com/symfony/symfony/pull/12293

Commits
-------

e638ccb Remove aligned '=>' and '='
improve error message for multiple documents

The YAML parser doesn't support multiple documents. This pull requests
improves the error message when the parser detects multiple YAML
documents.
[HttpFoundation] Minor spelling fix in PHPDocs
minor #12374 [HttpFoundation] Minor spelling fix in PHPDocs (GeertDD)

This PR was submitted for the master branch but it was merged into the 2.3 branch instead (closes #12374).

Discussion
----------

[HttpFoundation] Minor spelling fix in PHPDocs

| Q             | A
| ------------- | ---
| Fixed tickets |
| License       | MIT

Commits
-------

35791fd [HttpFoundation] Minor spelling fix in PHPDocs
[ClassLoader] Cast $useIncludePath property to boolean
minor #12371 [ClassLoader] Cast $useIncludePath property to boolean (GeertDD)

This PR was submitted for the master branch but it was merged into the 2.3 branch instead (closes #12371).

Discussion
----------

[ClassLoader] Cast $useIncludePath property to boolean

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

Commits
-------

32001a4 [ClassLoader] Cast $useIncludePath property to boolean
bug #12341 [Kernel] ensure session is saved before sending response (Tobion)

This PR was merged into the 2.3 branch.

Discussion
----------

[Kernel] ensure session is saved before sending response

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #6417, #7885
| License       | MIT
| Doc PR        | n/a

Saves the session, in case it is still open, before sending the response.

This ensures several things in case the developer did not save the session explicitly:

- If a session save handler without locking is used, it ensures the data is available
on the next request, e.g. after a redirect. PHPs auto-save at script end via
session_register_shutdown is executed after fastcgi_finish_request. So in this case
the data could be missing the next request because it might not be saved the moment
the new request is processed.

- A locking save handler (e.g. the native 'files') circumvents concurrency problems like
the one above. By saving the session before long-running things in the terminate event,
we ensure the session is not blocked longer than needed.

- When regenerating the session ID no locking is involved in PHPs session design. See
https://bugs.php.net/bug.php?id=61470 for a discussion. So in this case, the session must
be saved anyway before sending the headers with the new session ID. Otherwise session
data could get lost again for concurrent requests with the new ID. One result could be
that you get logged out after just logging in.

This listener should be executed as one of the last listeners, so that previous listeners
can still operate on the open session. This prevents the overhead of restarting it.
Listeners after closing the session can still work with the session as usual because
 Symfonys session implementation starts the session on demand. So writing to it after
it is saved will just restart it.

Commits
-------

b7bfef0 [Kernel] ensure session is saved before sending response