Security release: Sylius 1.14.21, 2.1.17, 2.2.12 and 2.3.2

This release round has a common thread: how much Sylius trusts what a request tells it. Six reports reached us in October, and each pointed at a place where that trust was misplaced. Rather than closing six symptoms, we followed each report to the code that caused it and asked what else rested on the same assumption.