updater: Move rev_sha1 addition before convertUserOptions

Execution of the script and addition of rev_sha1 are both 1.19
activities, but for some reason the issue has only shown up in 1.21.

* MysqlUpdater::getCoreUpdateList() declares that 'doMigrateUserOptions'
  should be executed before adding the field rev_sha1 into the revision table
* ConvertUserOptions::execute() calls User::saveSettings()
* User::saveSettings() at its very end calls $this->getUserPage()->invalidateCache()
  and that is where the revision query is joining the party.

Bug: 48820
Change-Id: Id0a6efc33a8c46fdc3e9c294aa2d005d46c7dda0
(cherry picked from commit 070b8b40fb9cc2b4912f9c1b06d93712c0b2ddf3)
Installer: page refresh should refresh list of supported DBs

There's no need to cache _CompiledDBs's value from the first installer load.
Instead, the list should be regenerated on every page load, as it's merely being
used for displaying the user list of DBs to choose from.

This solves a common setup confusion, where user starts with no DB support, gets
a friendly error message, installs php5-mysql as requested, but refreshing the
page won't make the error go away.

Bug: 31533
Change-Id: I2e7e5b4f72e7c11706d491a205e202008e2511da
(cherry picked from commit ed542f41daf10f336a9d32107246dc7394ebfb12)
Purge upstream caches when deleting file assets.

Inform upstream caches when a file asset is deleted by calling
SquidUpdate::purge(). This helps prevent unintentional information leakage in
the event that the asset is being deleted for reasons of license or content.

Bug: 51064
Change-Id: Ibf57e8f32d7dd04b8508a69706be5a40b49e5abd
Release note update for bug 51064.

Change-Id: Ic8070a09f605b8a8c12b0a2f24248d538f4c6206
Merge "Release note update for bug 51064." into REL1_21
test: run autoloader suite

The autoloader tests were not properly registed and would thus never
trigger an error whenever an entry is missing.

Also register PageORMTableForTesting which was missing though it does
not have any impact.

bug: 47750
Change-Id: If31598bb84b8acfc2064630850ebf720f2555129
SECURITY: Sanitize ResourceLoader exception messages

Prevent path disclosure when $wgShowExceptionDetails is false

Bug: 52746
Change-Id: Ia14ae21972192d291cb86dce65568e9e8b4674f7
SECURITY: Prevent tokens in jsonp mode

Add checks to token-returning functions to prevent returning tokens in
jsonp mode. This affects action=tokens, action=login,
action=createaccount, and action=query&list=deletedrevs.

Also, remove the "gettoken" parameter to action=block and
action=unblock, which has been deprecated since 1.20.

Bug: 49090
Change-Id: Ibeaa5c72d8084585092b15935a3f5709104bf7f7
SECURITY: Fix extension detection with 2 .'s

Fix IE6 extension detection, to prevent XSS in the API response.

Bug: 52746
Change-Id: If58a81b62209b36bd143a1766a8a20c9c34dbe3b
Updated release notes and version number

Change-Id: Idc89da165e96377d65be7f4a67805f2bb17920cd
Merge branch 'REL1_21' of https://gerrit.wikimedia.org/r/p/mediawiki/core into REL1_21