[1.6.x] Fixed #23307 -- Clarified the way max_num limits the output of formsets.

Thanks velle for the report.

Backport of 5f3806b861 from master
[1.6.x] Fixed #23431 -- Allowed inline and hidden references to admin fields.

This fixes a regression introduced by the 53ff096982 security fix.

Thanks to @a1tus for the report and Tim for the review.

refs #23329.

Backport of 342ccbd from master