Split Core.php into Constants.php and Core.php and adjust main.php startup

The recent flush filter fix had a problem that you couldn't set a custom
BASE_PATH in _ss_environment because that file didn't get included until
after checking the confirmation token. This patch pulls the part of Core.php
that defines BASE_PATH into a separate file that can be included earlier
in the startup sequence so that ParameterConfirmationToken can access it.

Core.php includes Constants.php with a require_once call, so for startup
scripts that don't pull in Constants.php themselves (like cli-script.php)
no change is needed.