Don't trust update server

Dont die when we're missing a route

Revert "Dont bother with stream_resolve_include_path if the path is already absolute"

Fix some PHPDocs

Some classes included via `use` did not even exist anymore.

In case the update server may deliver malicious content this would allow an adversary to inject arbitrary HTML into the response. So very bad stuff.

While signing the response would be better and something we can also do in the future (considering the code signing work), this is already a good first start.

Scrutinizer Auto-Fixes

Skip unavailable storages in scanner

This commit consists of patches automatically generated for this project on https://scrutinizer-ci.com

Deduplicate queued trashbin expire jobs

Dont bother with stream_resolve_include_path if the path is already absolute

Add Workflow app to shipped list

* fixes #20425
* this removes the argument trashbin size from the expire job - it is now
  calculated in the expire job
* the queue now detects properly that the job is already queue and doesn't
  add it again

Also allow empty value for no-HTTPS

Add full interface of server container as alias

Only reject ajax auth if user is really logged out

[3rdparty] bump symfony/console to 2.7.7

This makes it work better with old version of Nginx.

[3rdparty] Bump punic to 1.6.3

Split contexts and start of federation tests

Always installed apps includes the hardcoded ones from shipped.json

Users are available under it's own principal resource named 'principa…