Load the security bundle after the framework bundle

[baumannsven]

In the extension of the security bundle, the parameter %kernel.secret% is used. This provides the framework bundle. If it is not set, an error will occur after running composer (install|update).

This has changed in version 4.4.1 of the security bundle.
https://github.com/symfony/security-bundle/blob/v4.4.1/DependencyInjection/SecurityExtension.php#L66

The Contao 4.4 LTS is not affected by this.

The error can be reproduced in the method buildLoadingOrder of the ConfigResolver which shuffle the loading order.
https://github.com/contao/manager-plugin/blob/442c3b1360b2caa784cd38aa8b2997545f20f3e1/src/Bundle/Config/ConfigResolver.php#L95

uksort($loadingOrder, function() { return rand() > rand() ? 1 : -1; });

return $loadingOrder;

And additionally in the manager bundle plugin the order of the security bundle and framework bundle is changed.

contao/manager-bundle/src/ContaoManager/Plugin.php

Lines 93 to 94 in 8637010

	BundleConfig::create(FrameworkBundle::class),
	BundleConfig::create(SecurityBundle::class),

[leofeyer]

Shouldn't we make sure to always load the Symfony framework bundle before all other Symfony bundles? Just like we always load the Contao manager bundle first:

https://github.com/contao/manager-plugin/blob/ad489738c9d5e3079286e5e582efffb4bcb8c265/src/Composer/ManagerPluginInstaller.php#L262-L266

Maybe there are other Symfony bundles that react differently depending on whether the framework bundle is installed or not, too.

[baumannsven]

Therefore the bundles, which refer to what framework bundle should be marked with the set load after. I check this again.

[baumannsven]

I have now placed the framework bundle at the end in the manager bundle plugin. To test if the other bundles which are defined before don't cause an error. So everything should work with this pull request.

[leofeyer]

Thank you @baumannsven.