Security update

Security release for issue #2710653.

• Security update: proper escaping of category and notes on opening hours
• #2260505: Next/prev week is broken in development
• #1904642: Unable to uninstall module if using drupal multisite with table prefixes

• See Opening hours - Less Critical - Cross-Site Scripting (XSS) - SA-CONTRIB-2016-031
• #2409713: Categories are missing in Drupal.settings

- Updating xmlsitemap for DRUPAL-SA-CONTRIB-2016-030

Changes since 7.x-2.2:

Changes since 8.x-1.0-alpha1:

• DRUPAL-SA-CONTRIB-2016-030: Fixed URL added to the XSL title without being sanitized.
• #2395397 by fastangel, thechanceg, Dave Reid: Fixed doctype not set properly in sitemap.xsl.
• Remove unneeded spaces
• Remove duplicated logic in hook_cron
• Remove unwanted spaces
• Remove _xmlsitemap_sitemap_rehash_all() as it is not used