Fix lost form submissions on archives, the unlocked update finish and six more

Update Symfony to 7.4.23 (12 advisories in 8 packages).

- A form can be sent from /beitraege, /kategorie/... and /schlagwort/...;
  it answered 404 before anything was stored or mailed.
- Booleans reach the database as integers, so MySQL in strict mode
  accepts form submissions, task switches and plugin states.
- A stepped form with a required multiple choice shows its message
  instead of stopping on a TypeError.
- The second update step runs under the update lock; a concurrent
  finish no longer rolls a successful update back.
- Accordion entries and gallery images can be selected from the
  editor panel again.
- Category and tag names are escaped in the archive heading.
- Restoring a published page from the bin needs the publisher role.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

src/Controller/SystemController.php

@@ -177,6 +177,9 @@ final class SystemController extends AbstractController
         @set_time_limit(0);
         if ($request->request->getBoolean('finish')) {
             $ergebnis = $this->archive->finish($this->installation);
+            if ($ergebnis['laeuft'] ?? false) {
+                return $this->back(ArchiveUpdate::LAEUFT_BEREITS);
+            }
             $request->getSession()->set('update_steps', $ergebnis['steps']);
             $this->addFlash($ergebnis['ok'] ? 'success' : 'error', $ergebnis['ok']
                 ? 'Das Update ist fertig. Die Website ist wieder erreichbar.'
@@ -271,6 +274,10 @@ final class SystemController extends AbstractController
         }
         @set_time_limit(0);
         $ergebnis = $this->archive->finish($this->installation, $this->pruefung);
+        if ($ergebnis['laeuft'] ?? false) {
+            // Der andere Abschluss schreibt den Stand fort; die Systemseite fragt ihn weiter ab.
+            return new JsonResponse(['ok' => true, 'meldung' => ArchiveUpdate::LAEUFT_BEREITS, 'status' => $this->archive->status()]);
+        }
         $this->sendJsonAndStop(['ok' => $ergebnis['ok'], 'status' => $this->archive->status()]);
     }
 
@@ -311,6 +318,9 @@ final class SystemController extends AbstractController
         }
         @set_time_limit(0);
         $ergebnis = $this->archive->finish($this->installation);
+        if ($ergebnis['laeuft'] ?? false) {
+            return $this->back(ArchiveUpdate::LAEUFT_BEREITS);
+        }
         $request->getSession()->set('update_steps', $ergebnis['steps']);
         $this->addFlash($ergebnis['ok'] ? 'success' : 'error', $ergebnis['ok']
             ? sprintf('Update auf %s abgeschlossen. Die Website ist wieder erreichbar.', $offen['fassung'])