bug #25583 [HttpKernel] Call Response->setPrivate() instead of sending raw header() when session is started (Toflar)

This PR was merged into the 3.4 branch.

Discussion
----------

[HttpKernel] Call Response->setPrivate() instead of sending raw header() when session is started

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | symfony/symfony#24988
| License       | MIT
| Doc PR        | -

As described in #24988 I think the current handling of the `Cache-Control` header set by the `NativeSessionStorage` causes inconsistent behaviour.

In #24988 @nicolas-grekas states that if you start a session a response should be considered to be private. I do agree with this but up until now, nobody takes care of this on `kernel.response`.

I think we must always suppress the `NativeSessionStorage` from generating any headers by default. Otherwise the `Cache-Control` header never makes it to the `Response` instance and is thus missed by `kernel.response` listeners and for example the Symfony HttpCache. So depending on whether you use Symfony's HttpCache  or Varnish as a reverse proxy, caching would be handled differently.  Varnish would consider the response to be private if you set the php.ini setting `session.cache_limiter` to `nocache` (which is default) because it will receive the header. HttpCache would not because the `Cache-Control` header is not present on the `Response`.  That's inconsistent and may cause confusion or problems when switching proxies.

Commits
-------

dbc1c1c4b6 [HttpKernel] Call Response->setPrivate() instead of sending raw header() when session is started

Author: fabpot

DependencyInjection/FrameworkExtension.php

@@ -825,7 +825,7 @@ private function registerSessionConfiguration(array $config, ContainerBuilder $c
 
         // session storage
         $container->setAlias('session.storage', $config['storage_id'])->setPrivate(true);
-        $options = array();
+        $options = array('cache_limiter' => '0');
         foreach (array('name', 'cookie_lifetime', 'cookie_path', 'cookie_domain', 'cookie_secure', 'cookie_httponly', 'use_cookies', 'gc_maxlifetime', 'gc_probability', 'gc_divisor', 'use_strict_mode') as $key) {
             if (isset($config[$key])) {
                 $options[$key] = $config[$key];