Backport of 9ef2615d from master

Thanks Raphaël Hertzog for the report and help on the patch, and Tim Graham
for the review.

Backport of 170f7115 from master

Backport of 9c8a2ab8 from master

Backport of e11a08ee from master

Backport of 00d763a4 from master

Backport of 1369da676f3bd83d694ca5f00c5012f16b007acb from master

Backport of 32f0c8f7 from master

Backport of fc3409b0 from master

Backport of 99ec80f8 from master

Backport of 5edf25bd from master

Backport of 7b8008a0 from master

Backport of ebe994a4 from master

This is a security fix; disclosure to follow shortly.

Thanks Sam Cooke for the report and draft patch.

Backport of ead36e8a from master

Backport of 8bf1449e from master

Backport of 3db21c35 from master

Backport of e2b77ace from master

Avoided split_exclude() for Q when used as an expression.

Backport of bc87061a from master

Backport of 8b106cfa from master

Backport of fb94e7b8 from master

Backport of f3b51f51 from master

Refs #24503.
Backport of 1046c8af from master.

Backport of a0175724 from master

Backport of f5da4380 from master

Backport of e4f0e5a9 from master

Thanks Markus Holtermann for review.

Backport of 307acc74 from master

Backport of fc1eea59 from master

Thanks Carl Meyer and Tim Graham for the reviews.
Backport of 32260503 from master.

Backport of 2dee853e from master

Thanks Thomas Recouvreux for the report and Tim Graham for the tests and
review.
Backport of ae635cc3 from master.

Backport of a37dcfd0 from master

Backport of dce004ab from master

Backport of 3c8fe5dd from master

Backport of 81d4ce4a from master

Backport of ca51c559 from master

Arguments shown in example code (signal, sender, instance) appeared to
be the incorrect positional arguments for a post_save signal (which
might start as: sender, instance, created), as documented:
​https://docs.djangoproject.com/en/1.8/ref/signals/#post-save

Backport of 4f3c4442 from master.

Fixed crashes with ForeignKey to UUIDField and inheritance with UUIDField
primary keys.

Backport of ec74dba2 from master