Update the Recaptcha URLs for Google's new URLs.

Google updated the Recaptcha URLs to be hosted on google.com. While the
old HTTP URL still works (as a redirect), the old HTTPS URL doesn't seem
to be working.

We now make use of the new URLs.
Use an unguessable filename for all file attachment uploads.

FileAttachments now save with an unguessable filename. They contain the
real filename, but with a UUID prepended. This serves a couple purposes.

1) People can't guess/scan for common names.
2) Users can't craft malicious filenames with the intent to mess up an
   unsecured installation (such as naming a file .htaccess).

The original filename is stored in the database, which is useful for
display purposes. We never actually present the resulting filename
except in the HTML for linking/display.

The caption is now set to the filename by default, so there isn't
necessarily this weird "caption OR filename" thing. It's a sane default
that users can see and override.
Release Review Board 1.6.18.
Update the docs database for the latest schema changes.
Bump to 1.6.19 dev.
Add a missing release notes for CVE-2013-4795, fixed in 1.6.18.

This was a XSS vulnerability that was fixed as part of Djblets.