Fixed the bug that requesting protected or private action methods would cause 500 error instead of 404

allow using it from the gridview directly

Improved action filter and action execution flow by supporting installing action filters at controller, module and application levels

Fixes #2912: Relative view files will be looked for under the directory containing the view currently being rendered

issue #2852

Changed `Controller::afterAction()`, `Module::afterAction()` and `ActionFilter::afterAction()` to pass `$result` by value instead of reference

Fixes #1965: `Controller::findLayoutFile()` returns incorrect file path when layout name starts with a slash

Added Controller::enableCsrfValidation to support turning on/off CSRF validation for particular actions.

This reverts commit 9d7597d6, reversing
changes made to 6b6390f7.

Result of a discussion with @qiangxue
- there is not global Yii::$app->response anymore, every action has
  dedicated response class
- implementation allows using HMVC pattern now, nested actions do not
  interfer