Defensive programming: more urlencode/htmlentities

Make build_url return an URL, not HTML. This separates presentation
from data.

plugin_header's return value is unused, remove the unnecessary return.

At places where `printf("<tag att='%s'>", $x);` is used, it is now
converted to `printf("<tag att=\"%s\">", htmlentities($x));` since
the single quote is not escaped by default by htmlentities.

In case the canvas style is used, JS should use `textContent` instead
of `innerHTML` to avoid reading `&quot;` instead of `"`. Nobody (should)
use(s) IE6 anymore, so it is a safe change.

While at it, use the standard charset attribute of meta to specify
the character set (UTF-8).
Fix type confusion

index.php expects that collectd_hosts() always return an array for
array_diff. Since an empty array evaluates to FALSE anyway, do not
change the type and just return the empty array.

In base.php, if no files are returned, the loop is never called and
three variables are not initialized. Do it now.
security: Add missing input validation for plugin

This is a security bug. The contents of the file are not
immediately disclosed, but it could disclose environment information
to the attacker (when display_errors=1 and an ancient PHP version
is used that does not check for '\0' in `file_exists()`).
Use a more secure command line building method

Previously, a command is built by string concatenation. Here, the
distinction between a value and multiple params got lost. Solve this
by using an array for shell arguments. As the escaping is now removed
from the `rrd_gen_graph` function, the canvas style needs to manually
add those quotes to make the JS code still work. That only supports
double-quotes, so hopefully nobody creates a name with a double quote
as that would break the fragile JS command line parser.

Separate the rrdtool options from the rrdtool graph command to make the
`$graph_type == 'canvas'` option work (it would otherwise not understand
the `rrdtool graph - -a PNG` option).

Merge the SVG and PNG cases as they are the same except for the
Content-Type header.

Fix a missing html escape in a debug style.
Escape file argument for rrd_info

Also init info_array in case the output is empty.
Display a HTTP error if the command failed

... for instance, when using an overly large "s" parameter.
Fix regex for strange datadirs

If a datadir would contain characters with a special meaning in regex
(e.g. `/tmp/logs (new)`), then the function would blow up.
Fix overly permissive hostname validation, fix host check

`[\w\W]` matches EVERYTHING. Validation failed. Also remove `\d` as that
`\w` is a superset of it.

Also check that the host parameter is actually non-empty, otherwise
`collectd_plugins` will happily return results as the directory
`$CONFIG['datadir'] . '/' . ''` trivially exists...
Better x and y validation, report 400 on errors

Report 400 Bad Request on query errors instead of reporting 200 OK
(which can be cached).

Add some additional validation for the 'x' and 'y' parameters, to catch
underflow (test with `x=-10` for example). Also fix a typo in the error
message and include more details (the actual error).
type/base: print shellcmd when rrd_graph('debug') is called
graph: use filter_var instead of filter_input to allow overriding GET from detail.php

In detail.php $_GET['x'] and $_GET['y'] are overridden. filter_input
takes the original values. This results in NULL values.