(CE-1075) Apply MediaWiki 1.19.20 security release

This applies the MediaWiki 1.19.20 security release which makes
OutputPage::disallowUserJs also disable user styles, so user supplied
CSS isn't run on secure pages.

Also disallow user JS/CSS on our own signup/login forms.

This required a slight tweak to the WMF patch to avoid breaking Wikia::onTitleGetSquidURLs.

@owend