escape version string to prevent XSS for sure

* HTML escape the remotely retrieved version string printed to the HTML in order
  to prevent and attacks (if this would have been possible at all in 12
  characters).

The version string read from the davical.org webserver might be changed by an
attacker in order to perform XSS.
Even though this is highly unlikley (there are only 12 characters used) it's
better to HTML escape any such string that is printed to HTML.

This was originally reported at:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=703290
Merge pull request #3 from calestyo/master

escape version string to prevent XSS for sure
document closed Debian bug

* Document that Debian bug #703387 was closed by commit
  56968d48651518dd386a53bcd28c408ffe313aeb which I forgot to do before.
update addresses to the new canonical location

* Updated all addresses of the canonical git upstream repository and the issue
  tracker to the new ones.
make debug files pathnames more FHS compliant

* Changed the pathnames of the debug files to be a bit more FHS compliant.
RFC compliant CGI AUTH_TYPE usage

* Handle the content of the CGI AUTH_TYPE variable case-insensitively as defined
  by RFC 3875 Section 4.1.1.
support Apache’s REDIRECT_REMOTE_USER CGI env var

* In places where the CGI variable REMOTE_USER is read, support alternatively
  REDIRECT_REMOTE_USER, which is used by the Apache HTTPD Server instead, when a
  redirect was used.

Note: This alone is not enough yet, to fully support it in DAViCal. An analogous
      change (commit 29ddd89baaf65bda2560e51665a2e761abef4147) is necessary in
      AWL.
removed debian/README.Debian

* Removed debian/README.Debian which didn’t contain any useful information.
add fix for the OSX Contacts.app:
fix for CLASS attribute problem (CONFIDENTIAL value) and invalid processing of ->hide_alarm configuration option:
fix the append box when importing collections