Add an upper bound to the POST data SecurityComponent will consider.

'Kurita Takashi' has let us know that the previous patterns could be
abused by an evil doer. One could potentially send a very large deeply
nested POST data structure. Matching that structure could overflow the
PCRE limits causing a segmentation fault. Adding an upper bound will
solve the problem and I doubt anyone is doing POST data structures with
more than 10 levels of nesting.
Disallow hexadecimal input with inList.

Instead of turning on/off strict mode based on the user supplied input,
cast everything to strings and always use a strict check. This avoids
the potential issue of a bad user using hexadecimal when they should not
be allowed to do so. Thanks to 'Kurita Takashi' for pointing this out.
minor optimisation, refs comments on 81875cfeb1b8e5c414cf9de3c96dd2dde50150bc
Merge pull request #3878 from ceeram/optimize

minor optimisation, refs comments on 81875cfeb1b8e5c414cf9de3c96dd2dde50...
Fix CS
Merge pull request #3880 from markstory/incorrect-validation

Fix issues with Validation::inList() and SecurityComponent
fixes #3887 CSRF reusable token expires
increases time window in CSRF token expiry tests to 2 seconds

travis-cs failed with 1 second margin
Merge pull request #3888 from Schlaefer/fix-#3887-reusableCsrfExpires

fixes #3887 CSRF reusable token expires
Correct pattern matching.

Instead of 10 digits, it should limit at 10 groups.

Refs 1988e89e7382ba830c0172f399887595714c5b18
Fix an infinite recursion caused by missing plugin

When a MissingPluginException has caught when rendering an exception,
we should disable the plugin as needed to prevent an infinite recursion.
Merge pull request #3913 from chinpei215/master-exception-renderer-fix

Fix an infinite recursion caused by missing plugin
Update Model.php

Fixed the case on the link to the book, to match the anchor in the page.
Merge pull request #3925 from davidyell/patch-1

Update Model.php
A micro optimization of h()

In most cases, the first argument of h() will be a string.
Merge pull request #3927 from chinpei215/master-h-opt

A micro optimization of h()
Remove flaky test that was of questionable value.
Unify datetime column default values between MySQL and Postgres.

Datetime columns should have 'default' => null, in both Postgres and
MySQL.

Fixes #3837
Fix a race condition problem

Prevents Model::save() from generating a query with WHERE 1 = 1 on race condition.

Refs #3857
Fix CS