[guillaume-sainthillier]

Hello,

With a lazy firewall, TwoFactorAccessListener reads the token through security.token_storage on every request. This flags the session as used and turns every response into private, max-age=0, even for an anonymous visitor without session (#230).

This PR injects security.untracked_token_storage instead, like Symfony's own ContextListener and LazyFirewallContext. The token is still read, so the 2fa check doesn't change: a user in a 2fa process is still redirected to the 2fa form on paths without access control, unlike the change discussed in #230. Only what the application reads of the token (getUser(), is_granted()) makes the response private, as without the bundle.

The test app gets a /cacheable route without access control:

1. testAnonymousAccessToPathWithoutAnyAccessControlKeepsResponseCacheable fails without the fix (max-age=0, must-revalidate, private)
2. test2faProtectsCacheablePathWithoutAnyAccessControl checks that 2fa still protects it

Thanks,
Guillaume

[scheb]

Didn't know this existed! Good stuff! Thanks for including the test coverage :)

Released as v8.7.0