This retires the "Show assigned tickets on open queue" and "Show answered
tickets on open queue" settings.

And also fixup custom data fields used in conditions

The filter concept will allow for more sophisticated concepts including date
formatting, and will also allow plugin interaction.

And add options for custom data form fields

CVE-2017-14396

xss: Cached forms data

Encode html entities of cached form data

Format the advanced search title so that it will not allow javascript

Fix crash editing thread entry with inline image

This commit addresses an SQL injection vulnerability in ORM lookup
function.

* ORM implementation failed to properly quote fields, used in SQL
statements, that might originate from unsanitized user input.

* AttachmentFile lookup allowed for key based SQL injection by blindly
delegating non-string lookup to ORM.

forms: Proper Field Deletion

Orphaned Tasks on Dept. Deletion