Merge branch '6.0' into 6.1

* 6.0:
  Use external links instead of fake issue templates
  Fix description that does not work well
  Document deprecations in Security Tokens

Author: fabpot

.github/ISSUE_TEMPLATE/1_Bug_report.yaml

@@ -1,5 +1,5 @@
 name: 🐛 Bug Report
-description: ⚠️ See below for security reports
+description: ⚠️ NEVER report security issues, read https://symfony.com/security instead
 labels: Bug
 
 body:

.github/ISSUE_TEMPLATE/3_Support_question.md

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+    - name: Support Question
+      url: https://symfony.com/support
+      about: We use GitHub issues only to discuss about Symfony bugs and new features. For this kind of questions about using Symfony or third-party bundles, please use any of the support alternatives shown in https://symfony.com/support
+    - name: Documentation Issue
+      url: https://github.com/symfony/symfony-docs/issues
+      about: Symfony Documentation has its own dedicated repository.

.github/ISSUE_TEMPLATE/4_Documentation_issue.md

@@ -170,3 +170,19 @@ Security
  * Deprecate passing the strategy as string to `AccessDecisionManager`,
    pass an instance of `AccessDecisionStrategyInterface` instead
  * Flag `AccessDecisionManager` as `@final`
+ * Deprecate passing `$credentials` to `PreAuthenticatedToken`,
+   `SwitchUserToken` and `UsernamePasswordToken`:
+
+   Before:
+   ```php
+   $token = new UsernamePasswordToken($user, $credentials, $firewallName, $roles);
+   $token = new PreAuthenticatedToken($user, $credentials, $firewallName, $roles);
+   $token = new SwitchUserToken($user, $credentials, $firewallName, $roles, $originalToken);
+   ```
+
+   After:
+   ```php
+   $token = new UsernamePasswordToken($user, $firewallName, $roles);
+   $token = new PreAuthenticatedToken($user, $firewallName, $roles);
+   $token = new SwitchUserToken($user, $firewallName, $roles, $originalToken);
+   ```

.github/ISSUE_TEMPLATE/config.yml

@@ -407,6 +407,22 @@ Security
    ```
  * `AccessDecisionManager` does not accept strings as strategy anymore,
    pass an instance of `AccessDecisionStrategyInterface` instead
+ * Removed the `$credentials` argument of `PreAuthenticatedToken`,
+   `SwitchUserToken` and `UsernamePasswordToken`:
+
+   Before:
+   ```php
+   $token = new UsernamePasswordToken($user, $credentials, $firewallName, $roles);
+   $token = new PreAuthenticatedToken($user, $credentials, $firewallName, $roles);
+   $token = new SwitchUserToken($user, $credentials, $firewallName, $roles, $originalToken);
+   ```
+
+   After:
+   ```php
+   $token = new UsernamePasswordToken($user, $firewallName, $roles);
+   $token = new PreAuthenticatedToken($user, $firewallName, $roles);
+   $token = new SwitchUserToken($user, $firewallName, $roles, $originalToken);
+   ```
 
 SecurityBundle
 --------------