Fix XSS Vulnerability In "tpl.inc.php"

Another area was also outputting the unsanitized value.
Dashboard statistics should use 'period' as the date limiter

The statistics module on the dashboard was using the incorrect query parameter
'stop'. This meant that the module was loading all tickets from the report start
date to the present day. This commit fixes this by using the 'period' parameter
instead.
mpdf: Upgrade to 5.7.3
i18n: Package fonts with the Thai language pack

This patch also makes a slight edit to mPDF to allow better detection of
substitions in characters, as the DejaVu fonts shipped do not support Thai
glyphs.
i18n: Proper rtl layout for staff navigation
i18n: rtl: Fix button floating layout for RTL
i18n: rtl: Fix tab display for rtl viewers
i18n: Fix help tip popup for RTL display
i18n: rtl: Fix ticket thread layout
i18n: rtl: Fix dropdowns on action buttons
i18n: rtl: Fixup redactor rtl blocks
i18n: rtl: Fixup filedrop for rtl display
i18n: rtl: Fix quick note layout for rtl display
i18n: pdf: Use Adobe CJK output be default
i18n: rtl: Use linebreaks mode with Redactor and support rtl
Bug: attachments

Auto-detect inline attachments
Attached keepers to canned reply
oops: Properly format text thread bodies
filters: Fixup subfield listing for organizations
oops: Fix bad merge for list properties as sub-fields
forms: If an answer has no saved value, use the field

When processing the value of a DynamicFormEntryAnswer, if there is no
database-backed, value, then use the value of the associated field.