Fixed the bug that requesting protected or private action methods would cause 500 error instead of 404

allow using it from the gridview directly

Improved action filter and action execution flow by supporting installing action filters at controller, module and application levels

Fixes #2912: Relative view files will be looked for under the directory containing the view currently being rendered

issue #2852

Changed `Controller::afterAction()`, `Module::afterAction()` and `ActionFilter::afterAction()` to pass `$result` by value instead of reference

Fixes #1965: `Controller::findLayoutFile()` returns incorrect file path when layout name starts with a slash

Added Controller::enableCsrfValidation to support turning on/off CSRF validation for particular actions.