docs(upgrade): backfill upgrade sections for 0.18-0.24 (closes #656)

[s2x]

Description

Closes #656

UPGRADE.md documented breaking changes only up to 0.17 plus the new 0.25 section, leaving 0.18–0.24 undocumented despite BC-relevant changes highlighted in the issue.

Changes

• Backfill 7 upgrade sections (0.24, 0.23, 0.22, 0.21, 0.20, 0.19, 0.18) between 0.25 and 0.17 in descending order
• 0.24.1: MalformedRequestException replacing \InvalidArgumentException ([Security] A single control byte in any request header kills the worker process (remote unauthenticated DoS) #577) with Before/After catch narrowing
• 0.23: config-cache permission guard + umask(0077) ([Security] ConfigLoader includes generated PHP cache file; document trust requirement #323) and withHeader() deprecation ([Code Quality] Http\Request::withHeader misuses PSR-7 naming for a mutating method #364)
• 0.22: follow_symlinks default false ([Security] StaticFilesMiddleware follows symlinks under static root without opt-out #292) with migration snippet; ssl/cert and timeout notes
• 0.21–0.18: explicit no-mandatory-migration notes with notable changes
• CHANGELOG.md: entry under [Unreleased] → Docs

Proof of Work

docs/proof_of_work/0656-upgrade-md-sections-0-18-0-24/ — 1 review round (clean)

Code Review

Clean — no findings.