Sanitize $limitReport before outputting

Prevents possible injection of "-->" and other HTML by extensions using
the ParserLimitReport hook.

bug: 46084
Change-Id: Id97b6668da6df3e5e4c0acefffa00c82cac3c44a
(cherry picked from commit 69f96f65dd99e54b84e489e7d957b7526653474c)
Disable external entities in XMLReader

Temporarily disable loading entities in XMLReader when calling read()
with libxml_disable_entity_loader(true).

bug: 46859

Change-Id: I0b2ef270f15c7b4da17edee680bf7e2410919915
(cherry picked from commit 1ed76385c31f44c589f6e5a99c9c56f1f3f76728)
Disable external entities in Import

Temporarily disable loading entities in XMLReader when calling read()
during import.

(cherry picked from commit 77a8d576918b6a47b80a67a3653662a2d705d6c3)

Conflicts:
	includes/Import.php

bug: 47251
Change-Id: I0b39386e6cf4ec0244aab8ebc4095922511e2964