Changed `Controller::afterAction()`, `Module::afterAction()` and `ActionFilter::afterAction()` to pass `$result` by value instead of reference

Fixes #1965: `Controller::findLayoutFile()` returns incorrect file path when layout name starts with a slash

Added Controller::enableCsrfValidation to support turning on/off CSRF validation for particular actions.

This reverts commit 9d7597d6, reversing
changes made to 6b6390f7.

Result of a discussion with @qiangxue
- there is not global Yii::$app->response anymore, every action has
  dedicated response class
- implementation allows using HMVC pattern now, nested actions do not
  interfer