Test for SA-2014-002.

This is just the test for SA-2014-002 because I want the fix in a
separate commit that I can apply without the tests because I had to make
some fairly low level changes to CRM_Utils_System to get the test to work,
and I don't necessarily want to apply that patch to 4.3 which is more a
maintenance release.

If an anonymous user created a request like this:
http://civicrm.local/civicrm/ajax/permlocation?cid=1&ufId=2

It would return some JSON containing contact information for the contact
specified by the cid parameter. This would let anyone get that information
for any contact. Only users who have been granted permission to view that
information should be able to do this.

Added a test for this problem. Also I changed a few static methods in
CRM_Utils_System to call methods on $config->userSystem. This lets us
override those methods when doing UnitTests. We need to do this for
functions like CRM_Core_Page_AJAX_Location::getPermissionedLocation
because it calls CRM_Utils_System::civiExit which calls the PHP
function exit which then exits phpunit.

Needed similar things for CRM_Utils_System::redirect and
CRM_Utils_System::bounce which mess with the Apache headers and call PHP
exit which both cause problems with phpunit tests.
Fix for SA-2014-002.

If an anonymous user created a request like this:
http://civicrm.local/civicrm/ajax/permlocation?cid=1&ufId=2

It would return some JSON containing contact information for the contact
specified by the cid parameter. This would let anyone get that information
for any contact. Only users who have been granted permission to view that
information should be able to do this.
CRM-14856 - A test for this issue.

A test for the case where the user changes the cancelURL field to a
different URL than specified in the settings for a profile. We do not want
to allow this.

A test for the case where the user changes the add_to_groups field to be a
gid for a different group than the one allowed in the profile.

A few changes to the Utils_System classes to help with writing unit tests
for internal methods.
CRM-14856 (CIVI-SA-2014-003)

Backport of https://github.com/civicrm/civicrm-core/pull/3502 to get a fix
for some vulnerabilities on the profile form handling where the user could
construct a page with post_URL, cancel_URL, or add_to_group different from
what is specified in the actual profile. This would let the user add
themselves to any group in Civi.
Merge pull request #3718 from giant-rabbit/sa-2014-002-003/4.3

Tests and patches for SA-2014-002 and SA-2014-003 for 4.3