Drupal advisory SA-CORE-2018-001

… disabled (bastnic)

This PR was merged into the 5.4 branch.

Discussion
----------

[FrameworkBundle] enable metadata cache when annotation is disabled

| Q             | A
| ------------- | ---
| Branch?       | 5.4
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Tickets       | Fix #... <!-- prefix each issue number with "Fix #", no need to create an issue if none exists, explain below instead -->
| License       | MIT
| Doc PR        | symfony/symfony-docs#... <!-- required for new features -->

When using Annotations, annotations are cached at `AnnotationLoader` level.
Which is cleared when entities are changed. So the dev experience is optimal.

```
[ClassMetadataFactory.php](vendor/symfony/serializer/Mapping/Factory/ClassMetadataFactory.php") on line 51:
[Symfony\Component\Serializer\Mapping\Loader\LoaderChain](vendor/symfony/serializer/Mapping/Loader/LoaderChain.php&line=28#line28) {#543 ▼
  -loaders: array:1 [▼
    0 => [Symfony\Component\Serializer\Mapping\Loader\AnnotationLoader](vendor/symfony/serializer/Mapping/Loader/AnnotationLoader.php&line=33#line33) {#544 ▼
      -reader: [Doctrine\Common\Annotations\PsrCachedReader](vendor/doctrine/annotations/lib/Doctrine/Common/Annotations/PsrCachedReader.php&line=22#line22) {#262 ▼
        -delegate: [Doctrine\Common\Annotations\AnnotationReader](vendor/doctrine/annotations/lib/Doctrine/Common/Annotations/AnnotationReader.php&line=20#line20) {#263 ▶}
        -cache: [Symfony\Component\Cache\Adapter\PhpArrayAdapter](vendor/symfony/cache/Adapter/PhpArrayAdapter.php&line=32#line32) {#277 ▶}
        -debug: true
        -loadedAnnotations: array:14 [▶]
        -loadedFilemtimes: array:4 [▶]
      }
    }
  ]
}
```

When using yaml files, there is no cache at the loader level so I added in the past the same cache as for the prod env, as the metadata are effectively cleared when using only yaml config files.

#35109

The regression introduced by my patch is for people that do not use mapping files but use annotations.

#41961

But now, we are in the opposite situation: no cache for people using mapping files but not annotations.

On a current project it means loading 83 yaml files for each dev requests. It's not good at all.

A simple local fix is to add that in a dev services files.

```yaml
serializer.mapping.cache_class_metadata_factory:
    class: 'Symfony\Component\Serializer\Mapping\Factory\CacheClassMetadataFactory'
    decorates: 'serializer.mapping.class_metadata_factory'
    arguments: ['`@serializer`.mapping.cache_class_metadata_factory.inner', '`@serializer`.mapping.cache.symfony']
```

![image](https://user-images.githubusercontent.com/84887/224833940-b8e7ad72-e7f6-44e7-a924-0b20f2f0cdae.png)

A solution in Symfony could be:
1/ only yaml/xml mapping files (`enable_annotations: false`) : cache like prod => that what I did in this PR, as it fixes the current perf regressions on my different projects. There is no cache on yaml/xml file as soon as annotation is enabled (which is the default)
2/ add a cache at reader level for yaml/xml loader
3/ add a cache cleaner at metadata level when annotation are enabled

Commits
-------

1773dff [FrameworkBundle] enable metadata cache when annotation is disabled