Backport purge upstream caches when deleting file assets.

Bug: 51064
Change-Id: Ibf57e8f32d7dd04b8508a69706be5a40b49e5abd
SECURITY: Sanitize ResourceLoader exception messages

Prevent path disclosure when $wgShowExceptionDetails is false

Bug: 52746
Change-Id: Ia14ae21972192d291cb86dce65568e9e8b4674f7
SECURITY: Prevent tokens in jsonp mode

Add checks to token-returning functions to prevent returning tokens in
jsonp mode. This affects action=tokens, action=login, action=block,
action=unblock, and action=query&list=deletedrevs.

Bug: 49090
Change-Id: Ibeaa5c72d8084585092b15935a3f5709104bf7f7
SECURITY: Fix extension detection with 2 .'s

Fix IE6 extension detection, to prevent XSS in the API response.

Bug: 52746
Change-Id: If58a81b62209b36bd143a1766a8a20c9c34dbe3b
Update release notes and version

Change-Id: I3a2f166a05d5acef8b065de2cd1a609914d7999f
Merge branch 'REL1_20' of https://gerrit.wikimedia.org/r/p/mediawiki/core into REL1_20