Fixes #4489: RBAC PhpManager wasn't saving multiple assignmentsFixes #4489: RBAC PhpManager wasn't saving multiple assignments properly

Security component adjustments: fixed comment style, hkdf() and pbkdf2() are now protected, compareString() is now public

Fixes #4453: `yii message/extract` wasn't properly writing to po files in case of multiple categories

fixes #1249

Fixes #4318: `yii\helpers\Html::ul()` and `ol()` will return an empty list tag if an empty item array is given

Fixes #4051: Renamed `yii\caching\GroupDependency` to `TagDependency` and added support for associating multiple tags to a single cached data item

`yii\mongodb\Collection::buildRegexCondition()` added.

Adjusted Connection::transaction to provide Connection instance by default instead of transaction instance

do not use scripting as it is disabled by default and will cause edge
case queries to fail

fixes #4187