[1.6.x] Added release note stubs for 1.5.9 and 1.4.14.
[1.6.x] Prevented reverse() from generating URLs pointing to other hosts.

This is a security fix. Disclosure following shortly.
[1.6.x] Fixed #23157 -- Removed O(n) algorithm when uploading duplicate file names.

This is a security fix. Disclosure following shortly.
[1.6.x] Fixed #23066 -- Modified RemoteUserMiddleware to logout on REMOTE_USE change.

This is a security fix. Disclosure following shortly.
[1.6.x] Prevented data leakage in contrib.admin via query string manipulation.

This is a security fix. Disclosure following shortly.
[1.6.x] Update version number for security release.
[1.6.x] Added dates to release notes.

Backport of b902be798e from master
[1.6.x] Bumped version number post-release.