Better fix for Dropdown container options

Better fix for #3443 that does not break BC and allows widget to be extensible.

- Upgrade the documentation to match filter code
- Fix bad default behavior with Access-Control-Allow-Credentials
- Fix missing "s" in header Access-Control-Request-Method / Access-Control-Allow-Methods

temporarily skip app tests as they seem to be broken somehow

fixes #3026

fixes #4105, close #4376

`yii\web\Request::cookieValidationKey` is now automatically generated by the installation script for the basic and advanced application templates

Russian translation - semantic fix [skip_ci]

fixes #4276, close #4358

Example

```
['profit', 'number', 'min' => 0.01],
```

Value 0.01 is allowed

CORS Filter

Fixes #3443: Fixed `yii\bootstrap\Nav` and `yii\bootstrap\Dropdown` were generating wrong ids for submenus

fixes #4343

reverts 45e4973a

Fixes #4318: `yii\helpers\Html::ul()` and `ol()` will return an empty list tag if an empty item array is given

absolute auth timeout