The ThreadEntryWidget has a potential cross site scripting (XSS)
vulnerability if data was posted directly to the page hosting the widget

Vulnerable URLs:
view.php, open.php, scp/open.php, scp/tickets.php

The content received in the HTTP POST is now correctly escaped when it is
echoed back to the user agent.

- Change the table header from `Email Templates` to
  `Email Template Sets`
- Change `Add New Template` to `Add New Template Set`

This removes any possible confusion for new users. Instead of
thinking that they have one template because it displays one
template set, the new verbage will clarify that the table
at templates.php is a list of their template sets.

The original logic would read the count of attributes in the stream and then
read the first attribute in the constructor of TnefAttributeStreamReader.
Then the iterator interface would call ::rewind() before iterating to the
first item. rewind() set the @pos attribute to zero, which would cause the
attribute count (4-byte int) to be interpreted incorrectly as part of the
first attribute.

The new logic sets the position at 4 after rewind()ing, and does not read
the first attribute twice. It also properly detects the end of the attribute
stream by the number of attributes advertised as the first four bytes of the
stream (read into the @count attribute initially).

Show user search box when adding a new user

Link to org & user landing pages & kill pjax on internal pages

Show auxiliary data for the organization at the end

We're sticking with user for now until 2.0

On validation errors, `$faq` will be set to something non-null, like
`false`, but will not be an instance of a Faq article.

For PHP installations that have `mbstring.func_overload` enabled (set to a
value including `2`), the `strlen` function will be overloaded to use the
`mb_strlen` equivalent. Problematically, the internal encoding of `UTF-8`
will be applied to all file content, which will count UTF-8 characters
rather than bytes. This will cause the data to be saved correctly; however,
the `size` recorded in the %file table will be recorded incorrectly.

This patch allows the backend to report the size of the contents saved with
the request and provides a failsafe mechanism which will use the mbstring
equivalent if available, and the mbstring version is coded to use the `8bit`
as the encoding which will prevent reading characters.

References:
https://github.com/osTicket/osTicket-1.8/issues/552

Show auxiliary data for the organization at the end

Basic search is now limited to ticket number, email address and name.

Disable email alert sent to admin when a warning is logged due to ticket
rejection e.g when banned email or max open limit is reached.

- Add tips for fields that were previously overlooked.
- Fix some typos.
- Update tips to adopt the formatting conventions of tips.

- Proofread large portion of help tips.
- Implement help tip links in YAML files.
- Fix GUI spacing of some elements.
- Add <label> tags to a few form elements.

  * Drop _table_ titles
  * Drop _button_ titles and contents
  * Fixup titles to remove leading and trailing underscores in titles
  * Remove duplicated namespaces for ticket queue pages
  * Whitespace cleanup