Reduce database queries when returning the User list resource.

The User API resource checked profile.is_private on each User being
serialized in a list, which is expensive. Unfortunately, neither
select_related() nor prefetch_related() appear to properly cache reverse
ForeignKey relations, so they don't help us with this.

The best solution, it seems, is to tack on an extra query for our users,
storing the result of Profile.is_private on the User. The
is_profile_visible function checks for this, and attempts to do the
right thing by making use of that value, if it's available.
Fix overzealous escaping of periods when escaping for Markdown.

The period is listed as an escapable character, but it's really only
important after numbers at the beginning of a line. The regexes for
escaping now account for this, and don't escape periods elsewhere.

It's very likely we'll find we want to be even more thorough on some
other escaping, such as parens, but this is the most noticeable one.
Preserve the rich_text setting from the draft when publishing.

The rich_text setting in ReviewRequestDraft was never being set on the
ReviewRequest or on the ChangeDescription. With the new default of
False, any rich text made on a draft would end up being escaped on a
review request, and any escaped content would be double-escaped.
Move the "Extending Review Board" part of the manual up a level.

It doesn't really make sense to have this be part of the "User's Guide", since
ordinary users can't install or enable extensions. This moves the extensions
documentation up one level, to be a sibling of the "Web API Guide"