fix(exitError): Move cleanhtmljs() into `Lib.Util.php` and add missing include_once (refs #4872)

Move definition of cleanhtmljs() into `Lib.Util.php` and add missing
include_once("FDL/Lib.Util.php") in `Class.Action.php`.
fix(security): Prevent XSS in viewcard.php (refs #4917)
fix(Doc): Do not reset the withoutControl* properties when Doc::affect() is called (refs #4877)
test(Affect): Test withoutControl=true is retained after revise/modify (refs #4877)
feat(security): Set httpOnly on cookies (refs #4865)

Setting httpOnly to HTTP's cookies prevents JS code from reading (or
writing) the document.cookie, thus preventing some XSSes from stealing
session's cookie.
Merge pull request #1241 from Eric-Brison/3.3-E4920

feat(vault): begin introduce VaultManager (refs #4920)
Merge pull request #1236 from eguaj/3.3-A4872

fix(security): Prevent XSS in viewcard.php (closes #4917)(closes #4872)
Merge pull request #1239 from eguaj/3.3-A4877

fix(Doc): Do not reset the withoutControl* properties when Doc::affect() is called (fixes #4877)
Merge pull request #1240 from eguaj/3.3-A4865

feat(security): Set httpOnly on cookies (closes #4865)
feat(vault): vault temporary file (refs #4920)