Quote variables in manage_tabs and manage_container to avoid XSS [2.13]

From Products.PloneHotfix20160830.

The 3.0 release of the project contains no code. It allows projects
to declare a dependency on it for forward compatibility with Zope 4.

Apply hotfix 20160419 rebased

From Products.PloneHotfix20160419.

Optimize "OFS.ObjectManager.__contains__" method (backport)

Backported from master.

fix ReST rendering problem in changelog

[ci skip]

[ci skip]

[ci skip]

Conflicts:
	doc/CHANGES.rst

The ``fivetest.mo`` files are required by i18n tests.

This reverts commit a059efe1.

[ci skip]

You can use zest.pocompile (in combination with zest.releaser)
to generate and include .mo files.

Don't bail on WindowsError which is not existing on non-windows systems.

Discussion see https://github.com/zopefoundation/Zope/commit/87c5992e7e40604df206bb713e42bafd5919fe64

- Allow buildout to pick versions using ranges which enable updates
  to third-dot releases in the same line as previous pins.

- Show the versions picked.

See:  https://bugs.launchpad.net/zope2/+bug/789863

This change applies Leo Rochael's patch from:
https://bugs.launchpad.net/zope2/+bug/789863/+attachment/3624368/+files/0001-Make-the-request-object-unpublishable.patch

And the ideas from Richard Mitchell's patch at:
https://bugs.launchpad.net/zope2/+bug/789863/+attachment/3625765/+files/request_object.patch

Also, add an assertion that the WSGIResponse gets its 'Content-Length'
header correctly set.

Conflicts:
	doc/CHANGES.rst