[1.4.x] Fixed random aggregation_regress test_more_more_more() failure

The cause was assuming that an unordered queryset returns the values
always in the same order.

Backport of 33dd8f544205be923e2a06106909ebcd3583526b
[1.4.x] Corrected the section identifier for MySQL unicode reference.

Backport of b2514c02e1 from master
[1.4.x] Fixed a remote code execution vulnerabilty in URL reversing.

Thanks Benjamin Bach for the report and initial patch.

This is a security fix; disclosure to follow shortly.

Backport of 8b93b31487d6d3b0fcbbd0498991ea0db9088054 from master
[1.4.x] Prevented leaking the CSRF token through caching.

This is a security fix. Disclosure will follow shortly.

Backport of c083e3815aec23b99833da710eea574e6f2e8566 from master
[1.4.x] Fixed queries that may return unexpected results on MySQL due to typecasting.

This is a security fix. Disclosure will follow shortly.

Backport of 75c0d4ea3ae48970f788c482ee0bd6b29a7f1307 from master
[1.4.x] Added information on resolved security issues to release notes.

Backport of c07f3e60c2d455e36ba4ac339d4283d32bbc3814 from master
[1.4.x] Bump version numbers for 1.4.11 security release.
[1.4.x] Post release version bump.
[1.4.x] Fixed #22486 -- Restored the ability to reverse views created using functools.partial.

Regression in 8b93b31.

Thanks rcoup for the report.

Backport of 3c06b2f2a3 from master
[1.4.x] Bump version numbers for 1.4.12 bugfix release.
[1.4.x] Post release version bump.
[1.4.x] Added dates to release notes of today's release.

Backport of 68d264059abb21b96c4fe68bf4d99520268a451c from master
[1.4.x] Dropped fix_IE_for_vary/attach.

This is a security fix. Disclosure following shortly.
[1.4.x] Added additional checks in is_safe_url to account for flexible parsing.

This is a security fix. Disclosure following shortly.
Added release notes for 1.4.13.
Bumped version numbers for release.
Bumped version numbers post-release.
[1.4.x] Minor edits to latest release notes.

Backport of 860d31ac7a3bdd4b27db8b34b110b3d801ddaf8a from master
[1.4.x] Fixed #22859 -- Improved crossDomain technique in CSRF example.

Thanks flisky for the report.

Backport of 0be4d64487 from master
[1.4.x] Fixed #13794 -- Fixed to_field usage in BaseInlineFormSet.

Thanks sebastien at clarisys.fr for the report and gautier
for the patch.

Backport of 5e2c4a4bd1 from master