Add <security:allowcoreunload>.

When enabled (the default) this setting prevents the unloading of
core modules such as cmd_privmsg.
Merge pull request #476 from SaberUK/master+allowcoreunload

Add <security:allowcoreunload>.