If a HMAC of a submitted form is invalid (because it has been tampered
with), TYPO3 would previously throw an exception that leads to a
status code 500. This is incorrect behaviour, as the error comes from
bad user input and not a server error.

In case the HMAC of a submitted form is invalid, both extbase and
ext:form will now throw a BadRequestException, which will then lead to
a status code 400 (BAD REQUEST).

Resolves: #90134
Releases: master, 9.5
Change-Id: If4dad7ba27190b5992bab68b4ce64a423c0db645
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63272


Tested-by: TYPO3com <noreply@typo3.com>
Tested-by: Markus Klein <markus.klein@typo3.org>
Tested-by: Alexander Schnitzler <git@alexanderschnitzler.de>
Tested-by: Georg Ringer <georg.ringer@gmail.com>
Reviewed-by: Markus Klein <markus.klein@typo3.org>
Reviewed-by: Daniel Goerz <daniel.goerz@posteo.de>
Reviewed-by: Alexander Schnitzler <git@alexanderschnitzler.de>
Reviewed-by: Georg Ringer <georg.ringer@gmail.com>