Release v3.4.14

[fabpot]

Changelog (since v3.4.13...v3.4.14)

• security #cve-2018-14774 [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer (@nicolas-grekas)
• security #cve-2018-14773 [HttpFoundation] Remove support for legacy and risky HTTP headers (@nicolas-grekas)
• bug [HttpKernel] Fixes invalid REMOTE_ADDR in inline subrequest when configuring trusted proxy with subnet #28003 [HttpKernel] Fixes invalid REMOTE_ADDR in inline subrequest when configuring trusted proxy with subnet (@Netiul)
• bug [FrameworkBundle] fixed guard event names for transitions #28007 [FrameworkBundle] fixed guard event names for transitions (@destillat)
• bug [HttpFoundation] Fix Cookie::isCleared #28045 [HttpFoundation] Fix Cookie::isCleared (@ro0NL)
• bug [HttpFoundation] fixed using _method parameter with invalid type #28080 [HttpFoundation] fixed using _method parameter with invalid type (@Phobetor)
• bug [HttpKernel] Fix merging bindings for controllers' locators #28052 [HttpKernel] Fix merging bindings for controllers' locators (@nicolas-grekas)