Fix stored XSS vulnerability via do=export_metadata #4305

This prevents metadata export in general and also ensures the the
temporary $doc property in the metadata renderer is cleared in
document_end

apply code sniffer rules to inc/parser as well

apply PSR-12 constant visibility rule

PSR-12 says constants need their visibility declared from PHP 7.1
onwards

Apply rector fixes to inc/parser

metadata: consider webp and svg for first images as well

Update core code to make use of sexplode()

This makes use of our own explode mechanism everywhere were we expect a
fixed number of results.

move resolvers into File namespace

replace deprecated function calls

Replaces the use of resolve_pageid() and resolve_mediaid() with the
proper class invocations

PHP8 fix part 1: Trying to access array offset on value of type bool/null

replaced deprecated utf8 functions

For now this uses full qualified namespaces, sensible imports may come
later.

metadata.php: applied PSR2 Coding Style Guide

Merge branch 'master' into psr2

* master:
fix appveyor, download from https always
Issue #1250, associated unit test
translation update
translation update
fix(TASK_RECENTCHANGES_TRIM event

Merge branch 'master' into psr2

* master:
fix appveyor, download from https always
Issue #1250, associated unit test
translation update
translation update
fix(TASK_RECENTCHANGES_TRIM event): Add isMedia flag
rename task event
add missing visibility indicator and docblocks
translation update
refactor: Rename lib/exe/indexer.php to taskrunner.php ��
refactor: Move the remainder of code from lib/exe/indexer.php to TaskRunner::run ��
Fix for Issue#1250 Footnotes break metadata abstract saving
feat: Trigger new event when changelog is trimmed ✨
style(TaskRunner): automatic whitespace fixes ��
refactor: Extract code from lib/exe/indexer into new TaskRunner class ��
translation update

show more ...

Fix for Issue#1250 Footnotes break metadata abstract saving

some more visibility declarations

visibility definition for the renderers

I made a lot of things public that probaly should be protected. But many
syntax plugins do access renderer mechanisms directly, so better stay on
the safe sid

visibility definition for the renderers

I made a lot of things public that probaly should be protected. But many
syntax plugins do access renderer mechanisms directly, so better stay on
the safe side here.

The base renderer is now abstract.

show more ...

remove DOKU_INC checks

There is no need for this check, since these files should not have any
main code that is executed on direct call.

Fixes PSR1.Files.SideEffects.FoundWithSymbols

I supplemented the existing comments on the methods in which there was not enough information to the standard phpDoc.

Merge remote-tracking branch 'origin/master' into scrutinizerissues

Conflicts:
inc/media.php
inc/plugin.php
inc/template.php
lib/plugins/authplain/_test/escaping.test.php
lib/plugins/syntax.php

Update inbuilt renderers for node/leaf state in listitem_open
- includes, xhtml renderer adding 'node' class to <li> when it contains
child list(s)

more scrutinizer issue improvements

scrutinizer documentations issues

made $capture public in metadata renderer

some plugins (eg. the tag plugin) rely on it

simplified abstract caoturing in metadata renderer

updated doc blocks in metadata renderer

more reformatting