(bug 46905) Add "centralauthtoken" to API

Since third-party cookies (and therefore SUL) don't work with a growing
number of browsers, we need a non-cookie-based way for CentralAuth to
pass authentication data for CORS requests.

This adds a "centralauthtoken" parameter to the API "main" module, and a
new token type to action=tokens. The client requests a token from the
local wiki and then immediately uses it in the CORS request. The remote
wiki will then ignore all cookies and instead take the user data and
session ids from memcached using that token.

Bug: 46905
Replace image-based AutoLogin with iframes

The image-based Special:AutoLogin is not secure. Change to an
iframe-based method (using the same code as the js login check) instead.