Fix potential segfault in dns_get_record()

If the remote sends us a packet with a malformed TXT record,
we could end up trying to over-consume the packet and wander
off into overruns.
Fix bug #67349: Locale::parseLocale Double Free
Fix bug #67397 (Buffer overflow in locale_get_display_name->uloc_getDisplayName (libicu 4.8.1))
Fix bug #67492: unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion
Fix bug #67498 - phpinfo() Type Confusion Information Leak Vulnerability
Better fix for bug #67072 with more BC provisions
Fix test - because of big #67397 we don't allow overlong locales anymore
Update NEWS will all cherrypicked commits info
Prepare 5.5.14