- possible sql injection in monitor sys_state

- Made sure SQL backups from servers that differ from the server where the website is on can be restored. A download of the backup is not possible in such a case, therefore I hide the "Download" button.

- Changed tform_actions.inc.php to always provide oldDataRecord array for updates even when dbhistory = off.

FS#3632 - Adding websites with remote API is broken in 3.0.5.4p3 release.
Missed to commit one file for: FS#3634 - Add option to disable statistics for a website

- Added warning in the interface when a path for a shelluser is set that is outside of the website docroot.
- Added security settings feature to allow the root user of a server to control most aspects of whet the admin user of the controlpanel is allowed to do in system settings. This is especially useful for managed severs where the ispconfig admin user and the root user of the server are different persons.

additionally fixes this for client_update

- Added some cleanup code