No inline JS - Work in progress

**This is a work in progress - please don't merge**

Ok, there we go, as I stated in #1241 I'd like to move all inline JS scripts to external files. This will be a *really huge* security improvement since it allows us to disable the execution of inline JS which "prevents" a lot of XSS. 

Compatible (checked) apps at the moment:
- [x] files
- [x] files_encryption
- [x] files_external
- [x] files_sharing
- [x] files_versions
- [x] user_ldap
- [x] user_webdavauth

Compatible (checked) core features at the moment:
- [x] Personal
- [x] User
- [x] Apps
- [x] Admin
- [x] Help
- [x] Reset password
- [x] Login

Feel free to add your app on this list and/or help in this branch :)

Btw. you can easily check this with the Chrome developer tools:
![y5j1a4 q4m71](https://f.cloud.github.com/assets/878997/84194/2c2c7004-6404-11e2-911d-be1be006f07d.png)


Other TODOs: 
- [x] Allow admins to manually whitelist external hosts as ressource (e.g. for a piwik tracking script)
- [x] Add a PR on the apps repo.