2018-03-19: Merge remote-tracking branch 'upstream/master'

* upstream/master:
  Bump up mod version
  Ignore key bindings when downloading a map and when waiting for gamestate from the server. Original patch by @mickael9 https://github.com/mickael9/ioq3/commit/77e7012a657e2746eba94802f622e55479341b72
  Potential exploit fix: do not allow the client to modify the flag of a ROM or INIT cvar
  Potential exploit fix: do not allow loading .menu files from the /download/ subfolder
  Removed the binaries from the repository. We'll include them in the GitHub releases now.
  Updated the engine version
  Fix CVE-2017-6903 (#73)
  Server browser: when quickly refreshing the servers list multiple times, make sure that we're not displaying the same server several times. Patch by Tequila
  Exploit fix: on the client, check that a challengeResponse packet comes from the expected server address. This prevents a malicious server from hijacking a client's connection to a legit server.