Fix #16989: The bug_get_bugnote_count() function in the bug API always returns 0
Fix #17007: duplicate "<a " tag
Fix SQL injection vulnerability in adm_config_report.php

Jakub Galczyk (HauntIT blog http://hauntit.blogspot.com/) reported this
issue, introduced by f8a81a33880752364ea47bdd9a987bff986c81de in
MantisBT 1.2.13.

Root cause is the use of unsanitized inlined query parameters.

Fixes #17055
Localisation updates from https://translatewiki.net.
Bump version, update credits and release notes for 1.2.17
Changed version to 1.2.18dev [skip ci]
Merge branch 'master-1.2.x' into mantisbt-ultraware