Issue #2948579 by greggles, mcdruid, longwave, Chi, rabbitlair, alexpott, DKAN, beckydev, interX, sammuell: Block web.config in .htaccess (and vice-versa)

Issue #2783079 by david_garcia, alexpott: DRUPAL-SA-CORE-2016-003 Completely broke IIS drupal deployments

SA-CORE-2016-003 by alexpott, Michael Dowling, mlhess, xjm, Pere Orga, dawehner, greggles, coltrane, pwolanin, larowlan

Issue #2392153 by mparker17, hussainweb, chris.smith, alexpott, dawehner: Disallow composer.json and composer.lock from being indexed

Issue #2279105 by mgifford, nidaismailshah, thedavidmeister, amitgoyal, rpayanm, ameenkhan07, rakhimandhania, jhodgdon: Remove as many "..." and ellipsis characters from the codebase as possible without altering the meaning of text

Issue #1956698 by Gábor Hojtsy, xjm, alexpott, damiankloip, mgifford: Prevent access to YAML files using .htaccess and web.config.

Issue #2016629 by larowlan, neclimdul, sun, alexpott, jibran, ParisLiakos, donquixote, effulgentsia, msonnabaum: Refactor bootstrap to better utilize the kernel.

Revert "Issue #2016629 by larowlan, neclimdul, sun, alexpott, jibran, ParisLiakos, donquixote, effulgentsia, msonnabaum: Refactor bootstrap to better utilize the kernel."

This reverts commit cda051c4.

Issue #2016629 by larowlan, neclimdul, sun, alexpott, jibran, ParisLiakos, donquixote, effulgentsia, msonnabaum: Refactor bootstrap to better utilize the kernel.

- Patch #1183208 by effulgentsia, Niklas Fiekas, katbailey, no_commit_credit, catch: remove variable_get()('clean_url()') and switch to index.php/path pattern for dirty URL support.