_nl_find_locale: Improve handling of crafted locale names [BZ #17137]

Prevent directory traversal in locale-related environment variables
(CVE-2014-0475).

(cherry picked from commit 4e8f95a0)

Addiational backporting fixes:
  Added tst-setlocale3-ENV to localedata/Makefile

Conflicts:
	NEWS
	localedata/Makefile