v7.8.3

Patch release on top of v7.8.2. No API change.

• EditoraAuth returns the login redirect instead of sending it through Security::endSession(). Before, the following setcookie() failed with "headers already sent"; that exception was the only thing that stopped the protected action from running, and with symfony/http-foundation 8 it became a PHP fatal after the 302. Users still receive the same redirect.
• Security: Relations::order_relation() (drag and drop ordering, ajax_order) casts the instance and child ids to int. An authenticated user could rewrite the weights of every relation with input such as 2 OR 1=1. The event dispatch receives the same integer.

Verified on PHP 8.5.12 with Apache + PHP-FPM, with symfony/http-foundation 7.4 and 8.1: unauthenticated CMS requests redirect with no log entry, the injected ordering request no longer changes other rows while normal reordering still works, and 41 smoke checks (login/logout, 69 CMS screens, saving and creating instances, uploads with crop) pass with no warning logged. Lint clean on PHP 8.5, 8.3 and 7.4.