Backport security fixes to 1.x (#120)

Fix `include` tag being vulnerable to path traversal

Ensure that all relative and absolute file paths are contained by
a template path. We're looking at the string values so that any `../`
tricks don't work.

Thanks to Volker Dusch and the PHP Ecosystem security team for reporting this.

* Fix deserialization of untrusted data weakness (#119)

The unserialize filter has a weakness to arbitrary class usage which
can be combined with user input to create unserialization gadgets
which are used in RCE vulnerability chains.

I've also chosen to deprecate these functions. I see no reason to
continue having them when they have so many sharp edges. Applications
relying on these features, can add their own filters.

Thanks to Volker Dusch and the PHP Ecosystem security team for reporting this.

CI was broken.

* Open OS range
* Update for older phpunit

Fix deserialization of untrusted data weakness (#119)

The unserialize filter has a weakness to arbitrary class usage which
can be combined with user input to create unserialization gadgets
which are used in RCE vulnerability chains.

I've also chosen to deprecate these functions. I see no reason to
continue having them when they have so many sharp edges. Applications
relying on these features, can add their own filters.

Thanks to Volker Dusch and the PHP Ecosystem security team for reporting this.

Merge pull request #117 from cakephp/2.x-stan-twig

update stan and require secure twig version

adjust min twig version

Merge pull request #108 from cakephp/command-name

Add configurable underscore command naming

Merge pull request #103 from cakephp/chore/tests

Update tests to account for changes in CakePHP 5.1

Merge pull request #100 from ishanvyas22/bump-twig-to-fix-possible-sa…

…ndbox-bypass-security-vuln

Bump minimum twig version to v3.11 to fix Possible sandbox bypass security vulnerability

Merge pull request #98 from cakephp/fix-97

Add shim for date filter

Update to stable releases.

Merge pull request #94 from cakephp/merge-1x

merge 1.x => 2.x