This is a security fix.

Backport of a6ef025d from master

Also documented missing short command line options to fix #24134. This bumps
the minimum sphinx version required to build the docs to 1.3.4.

Thanks Simon Charette for review.

Backport of e519aab4 from master

Backport of 8ce8beb3 from master

Backport of 9644e2e9 from master

Backport of 9a5c9458 from master

Backport of 2436b83d from master

Backport of 93897a6a from master

Backport of 04564eb7 from master

Backport of 19d1cb14 from master

[1.9.x] Fixed #26147 -- Relaxed expected values in GIS tests to account for database/library differences.

Backport of 5aa53286 from master

Thanks kaifeldhoff for the draft patch.

Backport of 55481bcd from master

Backport of 5453aa66 from master

Thanks Bernd Schlapsi for the report.
Backport of 54236a2c from master.

Backport of 31817dd2 from master

Backport of 8e6a08e9 from master

Shallow copying of `django.utils.functional.LazyObject` or its subclasses has
been broken in a couple of different ways in the past, most recently due to
35355a4f.

Backport of 13023ba8 from master

Prior to 55f12f87, the template origin was available on each node via
`self.token.source[0]`. This behavior was removed when debug handling was
simplified, but 3rd-party debugging tools still depend on its presence.
This updates the Parser to set origin on individual nodes. This enables the
source template to be determined even when template extending or including is
used.

Backport of cfda1fa3 from master

Backport of 477274ac from master

This was causing an issue when calling the `migrate` command in a test case with
the `available_apps` attribute pointing to an application with migrations
disabled using the `MIGRATION_MODULES` setting.

Thanks to Tim Graham for the review.

Refs #24919

Backport of 4dcaa587 from master

Debian packages unconditionally byte-compile .py files on installation and
do not silence errors by design. Therefore, we need a way of shipping these
invalid .py files without a .py extension but ensuring that when we
template them, they end up as .py.

We don't special-case .py files so that the all the TemplateCommand
command-line options (eg. extra_files and extensions) still work entirely
as expected and it may even be useful for other formats too.

Backport of abc0777b from master

Backport of 9c43d825 from master

Thanks Shai Berger for the report.

Backport of 497b5d6f and
5e8685c1 from master

Backport of b0b45f9a from master

Backport of 2d36c7d5 from master

Backport of 145e9ca3 from master

Backport of 4c912d18 from master

Backport of 5925e20c from master

AUTOINCREMENT is dropped converting an AutoField to IntegerField
which isn't the point of this test. MySQL would warn or error about
this.

Backport of b49cc866 from master

Backport of bca9faae from master

default_storage_engine was introduced in MySQL 5.5.3.
storage_engine was removed in MySQL 5.7.5.

Backport of 79d0a4fd from master

`action="."` strips query parameters from the URL which is not usually what
you want. Copy-paste coding of these examples could lead to difficult to
track down bugs or even data loss if the query parameter was meant to alter
the scope of a form's POST request.

Backport of 77974a68 from master

Backport of 9a33d3d7 from master

Backport of fb4272f0 from master

If SQLITE_MAX_VARIABLE_NUMBER (default = 999) is changed at compile time
to be greater than SQLITE_MAX_COLUMN (default = 2000), which Debian does
by setting the former to 250000, Django raised an exception on queries
containing more than 2000 parameters when DEBUG = True.

Backport of f91b5a7e from master

Backport of ee596888 from master

Backport of 2d28144c from master

Backport of abcdb237 from master