TASK: Declare state properties in controller to be readonly

[mhsdesign]

In #3232 (comment) i mentioned that "replacing" the $this->response is probably not a good idea and we should disallow this via readonly. Mutating by object reference is the only way allowed.

I tried to actually enforce this via real readonly in #3283, but it has some severe flaws:

• There was only one place where we ourselves replace the variable for real, but i solved it with a mergeIntoParent or return.
• that means that controllers cant be singletons anymore (why are they declared as such even in general sometimes???)
  • the only usecase of a controller being a singleton would be for forwarded requests, but that is hacky as hell to then rely on internal state :D
• In widgets we rely on that the controller's process to be called multiple times:

  flow-development-collection/Neos.FluidAdaptor/Classes/Core/Widget/AbstractWidgetViewHelper.php

  Line 241 in 465c80b

  $subResponse = $this->controller->processRequest($subRequest);

  which is also not forbidden per se.

As compromise i suggest to use the read only annotation to make people aware.

Upgrade instructions

You should never replace any of the stateful properties of the action controller.

Review instructions

This pr should not be merged before targeting 9.0.
See #3232 (comment) for explanation.

TODO

• Can the ignore readonly be by any chance breaking??
  like use Neos/Flow/Annotations/Inject as readonly