[SECURITY] Ensure validity of parameters submitted to ThumbnailController

[SECURITY] Ensure validity of parameters submitted to ThumbnailController

Parameters submitted to ThumbnailController via HTTP GET query parameters
can contain arbitrary information. Thus, it has to be verified that those
parameters are valid by signing them with a HMAC.

Prior to that the source code was vulnerable to information disclosure as
well as denial of service attacks due to unsanitized user input. A valid
backend user account was required in order to make use of these flaws.

Since the change which introduced this behavior was not released yet, the
security fixes are handled in public without additional announcements.

Resolves: #85875
Releases: master, 8.7
Change-Id: Ia53ba3756f140b0728b8fd1fb7e0527836639a6b
Reviewed-on: https://review.typo3.org/57953
Tested-by: TYPO3com <no-reply@typo3.com>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
Reviewed-by: Frank Naegler <frank.naegler@typo3.org>
Tested-by: Frank Naegler <frank.naegler@typo3.org>