fix [Bug 24911] $wgSelectCategoryRoot ignored on Special:Upload

This is done by using NS_IMAGE instead of NS_SPECIAL when $isUpload is
true.

Change-Id: Ibf401165596b69703f355fb0f5a59782865069da