Make calling wfMangleFlashPolicy configurable

Add $wgMangleFlashPolicy so sites that define a safe master flash
policy can disable mangling of the <cross-domain-policy> string.

Backport, originally committed by csteipp

Bug: 66776
Change-Id: Ic0db939aae9d0bb6bdfc3cd9ce282661bad46783