backport fix for CVE-2014-0081 (XSS vulnerability in number_to_currency)

Note that number_to_percentage is not affected, number_to_human does not
exist, and only the :format parameter to number_to_currency is not
escaped.
make test less flakey on vagrant VM
update relase workflow
package 2.3.18.8