* Strip CRLF from message headers in SmtpTransport

Strip CRLF bytes from message headers when delivering mail by
SmtpTransport. This prevents header injection should userland code
supply user data into messages headers.

Thank you to Himanshu Anand for reporting this issue.

* Fix failing test from previous fix

* Fix php incompatibility.

Fix parameter handling in FunctionsBuilder (#19520)

Fix weakness in FunctionsBuilder

Several methods did not explicity label their parameters as unsafe, so
it is possible for an application developer to mistakenly supply user
controlled data into these parameters creating a SQL injection vector.

Thank you to Himanshu Anand for reporting this issue.

Backport #19520 to 4.x

Handle %2f in routing more consistently

Currently path prefix matching does not treat %2f as /, and `Route` has
an option for it. In the past we've made changes in this area
(#18050, #16110) to make urldecoding optional, and to intentionally
decode urlencoding in path segments to support non-ascii applications.

We got a report on the security list for a potential issue where *if*
an application enforced authorization within path prefixed scopes, and
had fallback routes enabled, then one could potentially bypass the scoped
middleware and hit the fallback routes which inconsistently handle %2f.

These changes align the behavior of urldecoding between RouteCollection
and Route with a new shared internal function. I thought a function was
better than exposing a static method on a public class.

Thanks to Rotem Reiss for reporting this issue.