Update Symfony http-kernel to 4.4.13 to address CVE-2020-15094

Note that core is not vulnerable to this issue, so we've agreed this update can be handled in public. The main annoyance is automated security testing failing because of the attached http-kernel update.

I think this should be considered major or critical and requires an immediate core release to upgrade symfony/http-kernel.

My understanding is that best practice is for end users to require drupal/core-recommended instead of drupal/core. This pins symfony/http-kernel to a vulnerable version with no way for end users to override it. *

This means that out of the box, all new Drupal sites build on drupal/recommended-project (which also depends on drupal/core-recommended) will also be affected with no possibility of making them secure without a new release.

This is partially mitigated if the vulnerability doesn't actually affect Drupal, but this will still wreak havoc given how many users probably make use of automated security scans and Composer security advisories.

* technically you might be able to use Composer version aliases in your composer.json or fork drupal/core-recommended or something to override it, but let's not go there

9.1.x also needs its own patch apparently.

I checked each of the patches and the 9.1/9.0/8.9 patches contain the minimum set of changes required to upgrade the package in question.

The 8.8 patch contains additional funding information as it was created with Composer 1.10 and the previous lock file must have been created with Composer 1.9, but this won't affect anything and it is probably better to be consistent.

Therefore this is RTBC assuming the tests pass.

Committed/pushed the respective patches to all four branches.

I think it'd be nice to add Roave/SecurityAdvisories library to Drupal core, so created #3168853: Add Roave/SecurityAdvisories to Drupal core to discuss.

Just realised that this only updates symfony/http-kernel and not all of Symfony as per the title, but I suppose this is a technicality, we don't need point releases to be in sync as far as I know (unless a bug fix relies on another bug fix in a related component, I suppose).

@longwave, we generally limit the updates we do in patch releases to the affected component(s). We can have a further update of Symfony in 9.1.

Tagging "Needs followup" for that, since #3157296: Upgrade dependencies prior to 9.1.0 just updated Symfony components to 4.4.12.