Bug 13425 - XSS in opac facets - Patch for 3.16

To Test
1/ Craft a url like /cgi-bin/koha/opac-search.pl?q=123&sort_by='"><script>prompt('Happy_Holidays')</script>&limit=123

It is important it must return results and facets

2/ Notice the js is executed
3/ Apply the patch test again

Test this one both in prog and bootstrap please

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
Increment version for 3.16.5 release

Signed-off-by: Mason James <mtj@kohaaloha.com>
fix typo in release notes