fixes #17314 - use *_subnets permissions for Subnet subclasses

Fixes #17277 - quote host properties

fixes #17300 - accept Nic::Bond#attached_devices string inputs

Fixes #16971 - CVE-2016-7077 remove unauthorized checkboxes

Fixes #15498 - removes scopes from includes in taxonomix

Fixes #17195 - CVE-2016-8634 escape html in alert text

The alert helper used to mark the alert text as html_safe by default.
However, in some cases it may be possible for a user to enter custom
text into the alert message leading to a possible XSS vulnerability....

Fixes #17256 - ignore order in Authorizer

Fixes #17006 - added SSH BMC provider

Fixes #17264 - remove duplicit admin check

Fixes #16546 - update facts on existing hosts

when create_new_host_when_facts_are_uploaded is set to false