Fix for sessions with taken attendance show twice in student report.

The two queries have been refactored into a single query using UNION
bump version
Security fix to prevent access to other students attendance
version bump for security release
update grade_items and capability tables
use cross-db update of capabilities
CONTRIB-4754 Added upgrade step to account for name change from
"attforblock" to "attendance":
- updated itemmodule field in the grade tables
- updated role_capabilities table to preserve old capabilities
- deleted old data from capabilities and role_capabilities tables