escape: Use the standard library where possible

Newer versions of pyflakes no longer require this.

Many of these functions were necessary in Python 2, but are now
redundant. We can simply use the standard library in many cases.
The only major change is in xhtml_unescape, where we now reject
invalid character references such as surrogates and control characters.

Update docs throughout to be more specific about differences from the
standard library. Also be more complete about the ``plus`` option to
the url escaping functions.

Fixes #3186

docs: Fix build after readthedocs/readthedocs.org#10638

The old magic for sphinx_rtd_theme has been removed; now we should
handle the theme in the same way we do for local builds.

ioloop,concurrent: Fix reference cycles

Pypy doesn't have the same refcount fast-path as cpython so the
gc behavior is different and this test is irrelevant.

Local/attribute dicts are reported a bit differently here.

In a few places we were referring to a future via a closure instead
of using the reference passed as an argument to the callback.  This
sometimes causes a reference cycle that can slow GC. This commit
adds a test which covers two of the cases (chain_future and the
concurrent.future branch of add_future) while the third was found by
inspecting other calls to add_done_callback for obvious instances of
this pattern.

Fixes #2620

This script was only ever run irregularly on its own; bring it in
to the test suite so it can be run automatically.

httpclient_test: Increase test_destructor_log timeout

This test has recently become flaky on windows CI, and before
investigating further, see if it's just because the CI machines are
overloaded and subprocesses are slower on windows.

Release notes for 6.3.3

httpserver_test: Add ExpectLog to fix CI

The github security advisory feature lets you make private PRs but
it apparently doesn't support CI so this log failure wasn't caught
until after the PR was merged.

http1connection: Make content-length parsing more strict

Content-length and chunk size parsing now strictly matches the RFCs.
We previously used the python int() function which accepted leading
plus signs and internal underscores, which are not allowed by the
HTTP RFCs (it also accepts minus signs, but these are less problematic
in this context since they'd result in errors elsewhere)

It is important to fix this because when combined with certain proxies,
the lax parsing could result in a request smuggling vulnerability (if
both Tornado and the proxy accepted an invalid content-length but
interpreted it differently). This is known to occur with old versions
of haproxy, although the current version of haproxy is unaffected.

web_test: Fix open redirect test on windows

Drive letters in windows absolute paths mess up this test,
so remove them and use a path relative to the drive root instead.

Fix syntax error in docstring

Update mypy/typeshed, update a few types

This required a recent update to typeshed/mypy.

Fixes #3093

Fixes a conflict between pip-tools and pip.

autoreload: Various updates

This flag terminates the autoreload loop after the first successful
run. This makes it possible to cleanly shut down a process that is using
"python -m tornado.autoreload" without printing a traceback.

Fixes #2398

build(deps): bump certifi from 2022.12.7 to 2023.7.22

Bumps [certifi](https://github.com/certifi/python-certifi) from 2022.12.7 to 2023.7.22.
- [Commits](https://github.com/certifi/python-certifi/compare/2022.12.07...2023.07.22)

---
updated-dependencies:
- dependency-name: certifi
  dependency-type: indirect
...
Signed-off-by: Ndependabot[bot] <support@github.com>

A previous commit added support for using autoreload within programs
that were started as directories; this commit supports them when
run with the -m tornado.autoreload wrapper.

This change may have side effects for file mode since we now use
runpy.run_path instead of executing the file by hand (I don't think
the run_path function existed when this code was originally written).

This will make it easier to add other options (for #2398)

Running a directory has some but not all of the behavior of
running a module, including setting __spec__, so we must be careful
not to break things by assuming that __spec__ means module mode.

Fixes #2855

build(deps): bump pygments from 2.14.0 to 2.15.0

Bumps [pygments](https://github.com/pygments/pygments) from 2.14.0 to 2.15.0.
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](https://github.com/pygments/pygments/compare/2.14.0...2.15.0)

---
updated-dependencies:
- dependency-name: pygments
  dependency-type: indirect
...
Signed-off-by: Ndependabot[bot] <support@github.com>