Always apply the IE security fix in the Environment class

Apply the IE security fix to both Environment::get('queryString') and Environment::get('requestUri') and use Environment::get('queryString') instead of $_SERVER['QUERY_STRING'].
Merge pull request #7453 from contao/feature/ie-security-fix
Send the request token when toggling the visibility of an element (see #7406)
Correctly store the model in Dbafs::addResource() (see #7440)
Strip insert tags recursively in the strip_insert_tags() function
Add the encodeRequestString() method to the Environment class
Add a missing change log entry
Merge branch 'hotfix/3.2.16' into release/3.4.0

Conflicts:
	assets/contao/js/core.js
	system/docs/CHANGELOG.md