merge security release:

* (bug 47251) SECURITY: Disable external entities in Import
* (bug 46859) SECURITY: Disable external entities in XMLReader
* (bug 46084) SECURITY: Sanitize $limitReport before outputting
* (bug 43594) Fix notices displayed on PHP 5.4
* (bug 40585) Don't drop 'step="any"' in HTML input fields.