Polishing
Apply extra checks to static resource handling

- remove leading '/' and control chars
- improve url and relative path checks
- account for URL encoding
- add isResourceUnderLocation final verification

Issue: SPR-12354
Update changelog
Next Development Version
MethodParameter generally uses volatile variables where applicable now (as well as a local copy of the parameterNameDiscoverer field)

Issue: SPR-12453
(cherry picked from commit 7fcadaa)
Rearranged WebAsyncTask constructor interdependencies and assertions

Issue: SPR-12457
(cherry picked from commit aadb93f)
Polishing
(cherry picked from commit 2675ce7)
Avoid early initialization of Derby driver (for "derby.stream.error.method" system property)

Issue: SPR-12437
Revised fix for SPR-12334, now finding duplicates at the collectImports level

Issue: SPR-12442
Use https for maven repositories
(cherry picked from commit 493e846)
Fix location checks for servlet 3 resources

SPR-12354 applied new checks to make sure that served static resources
are under authorized locations.

Prior to this change, serving static resources from Servlet 3 locations
such as "/webjars/" would not work since those locations can be within
one of the JARs on path. In that case, the checkLocation method would
return false and disallow serving that static resource.

This change fixes this issue by making sure to call the
`ServletContextResource.getPath()` method for servlet context resources.

Note that there's a known workaround for this issue, which is using a
classpath scheme as location, such as:
"classpath:/META-INF/resources/webjars/" instead of "/webjars".

Issue: SPR-12432
(cherry picked from commit 1214624)
Polishing

Issue: SPR-12462
(cherry picked from commit 5be50c8)
ExtendedBeanInfo ignores invalid bean properties (analogous to the JavaBeans Introspector)

Issue: SPR-12434
(cherry picked from commit b45f1aa)
Revised SqlRowSet javadoc

Issue: SPR-12476
Polishing

Issue: SPR-12476
(cherry picked from commit c89d8ec)
Polishing
(cherry picked from commit 50c578c)
Consistent resolution of Class methods and static methods

Issue: SPR-12502
(cherry picked from commit 9ef0bdc)
Consistent bridge method handling in annotation post-processors

Issue: SPR-12495
Issue: SPR-12187
(cherry picked from commit d97add0)
AbstractFallbackTransactionAttributeSource's DefaultCacheKey takes targetClass into account (again)

Issue: SPR-12536
AbstractApplicationEventMulticaster populates ListenerRetriever cache in fully synchronized fashion

Issue: SPR-12545