This is a security fix.

Thanks Ali Lozano for the report and the initial patch, and Tim Graham for
the review.

Thanks František Malina for the report.

HStoreField now converts all keys and values to string before they're
saved to the database.

Thanks kaifeldhoff for the draft patch.

I'm always around for a consult or a discussion but I haven't been an active contributor in a long time.

Still <3 everyone in this project and python at large.

Thanks Bernd Schlapsi for the report.

Shallow copying of `django.utils.functional.LazyObject` or its subclasses has
been broken in a couple of different ways in the past, most recently due to
35355a4f.

Prior to 55f12f87, the template origin was available on each node via
`self.token.source[0]`. This behavior was removed when debug handling was
simplified, but 3rd-party debugging tools still depend on its presence.
This updates the Parser to set origin on individual nodes. This enables the
source template to be determined even when template extending or including is
used.

This was causing an issue when calling the `migrate` command in a test case with
the `available_apps` attribute pointing to an application with migrations
disabled using the `MIGRATION_MODULES` setting.

Thanks to Tim Graham for the review.

Refs #24919

Debian packages unconditionally byte-compile .py files on installation and
do not silence errors by design. Therefore, we need a way of shipping these
invalid .py files without a .py extension but ensuring that when we
template them, they end up as .py.

We don't special-case .py files so that the all the TemplateCommand
command-line options (eg. extra_files and extensions) still work entirely
as expected and it may even be useful for other formats too.