[ci skip] Add a link to PHP bug 54709 in is_really_writable()'s docblock
Partially fix #2667
Re-add 'on\w*' to evil attributes (rel #2667)
Fix CI_Security::_remove_evil_attributes() being way too aggressive
Previous commit caused side effects ...
Add <math> to 'naughty' HTML elements