Drupal 8.0.4, SA-CORE-2016-001 by Alan Evans, benjy, berdir, catch, DamienMcKenna, Dave Reid, David_Rothstein, dsnopek, FengWen, fnqgpc, greggles, Gábor Hojtsy, klausi, larowlan, Pere Orga, plach, pwolanin, quicksketch, stefan.r, StryKaizer, YesCT

(cherry picked from commit f25feddd)

Conflicts:
	core/lib/Drupal.php

Issue #2565895 by dawehner, stefan.r, googletorp, effulgentsia, lauriii, jcnventura, David_Rothstein, catch, xjm, joelpittet, pwolanin, plach, larowlan, cilefen: Add a new :placeholder to SafeMarkup::format() for URLs that handles bad protocols

Issue #2545972 by alexpott, joelpittet, ericjenkins, stefan.r, Wim Leers, Cottser: Remove all code usages SafeMarkup::checkPlain() and rely more on Twig autoescaping

Issue #2457781 by prateekMehta, stefan.r, AjitS, hussainweb: Use Utility\Html class instead of Utility\String for decodeEntities() function

Issue #2457887 by prateekMehta, stefan.r, rpayanm, alexpott: Use Utility\SafeMarkup class instead of Utility\String for placeholder(), checkPlain(),format() functions

Issue #2455083 by dawehner, larowlan, klausi, David_Rothstein, hefox, tsphethean, dstol, DamienMcKenna, Pere Orga, benjy: Open redirect fixes from SA-CORE-2015-001 need to be ported to Drupal 8

Issue #2417793 by effulgentsia, Wim Leers, YesCT, yched, dawehner: Allow entity: URIs to be entered in link fields

Issue #2364157 by mpdonadio, dawehner, martin107, Berdir, pcambra, naveenvalecha, tim.plunkett: Replace most existing _url calls with Url objects

Issue #2282673 by stevepurkiss, ParisLiakos, mgifford: Add a PHPunit test for not using Drupal\Core code in Drupal\Component.

Issue #2343661 by larowlan, tim.plunkett | xjm: Rename l() to _l() and url() to _url(), and document replacements.

Issue #2343651 by xjm, tim.plunkett, Wim Leers, dinarcon, dawehner: Remove most remaining l() calls.

Issue #2076325 by neclimdul, Mile23, alexpott: Fixed Drupal\Component\Utility\Url::externalIsLocal() is wrong in common cases.

Issue #1998638 by damiankloip, dawehner, kim.pepper, cosmicdreams, alexpott, larowlan, Damien Tournoud: Replace almost all remaining superglobals (, , etc.) with Symfony Request object.

Issue #1998638 by damiankloip, dawehner, kim.pepper, cosmicdreams, larowlan, Damien Tournoud: Replace all remaining superglobals (, , etc.) with Symfony Request object.

Issue #2010024 by damiankloip, dawehner, ParisLiakos: Move url related functions to a new Url component.