feature(users): making nicer lost password process

1. User clicks "forgot password" and makes request
2. User receives via e-mail a URL to reset password
3. Accessing URL gives user a form to set her new password (uses temporary session bound to user account, but not logged in)
4. If password fields agree (and pass requirements), the password is set on the account, and the user is logged in.

There's just no need for the temporary password and forcing the user to login and change it.

Fixes #5886
chore(users): differentiating between user changing password and admin reset
security(users): making change password emails expire
chore(users): refactoring password reset action and function

Password reset action is using force_user_password_reset function.
The execute_new_password_request function sends the password by email
when it's generated randomly.
chore(output): add deprecation warning and update docs

Adds a deprecation warning for use of js attribute, updates docs with an example, removes the todo for style (support for this would require additional overhead for checking proper tokenization, whether or not style properties are closed with semicolon etc)
fix(core): Not redirecting in plugin and site entity views.

This redirect is infuriating to encounter if you pass invalid options to ege() and wind up on the index page for no apparent reason.

Fixes #4439.
fix(security): Implements stronger remember me cookie strategy

This implements remember me tokens using a greater entropy pool,
replacing codes as users return to the site, and mitigating a
brute-force attack by introducing a delay when an invalid elggperm
cookie is given. For admins, the tokens are removed immediately.
fix(routing): prevent upgrade if .htaccess needs updating

The router relies on a querystring added via URL rewriting by
the web server. If missing, this would lead to looping redirects
or showing only the index page. This requires the URL rewriting
strategy to be in place before the upgrade can run.

Fixes #6521
chore(views): moved check to avoid an array index warning
chore(oauth): compatibility with OAuth PHP module
Merge pull request #6562 from sembrestels/warning-array-index

chore(views): moved check to avoid an array index warning
fix(router): better handles invalid cache requests

If a cache request doesn't match the pattern, we no longer
continue to march on into errors.

Fixes #6559
fix(menus): eliminates warnings in section menus

Handles case where $vars['items'] is empty/not an array.

Fixes #6558
Merge pull request #6567 from mrclay/6558

fix(menus): eliminates warnings in section menus
Merge pull request #6566 from mrclay/6559

fix(router): better handles invalid cache requests
Merge pull request #6565 from sembrestels/twitter-oauth

chore(oauth): compatibility with OAuth PHP module
fix(ckeditor): makes sure basepath is set early enough

If CKEDITOR_BASEPATH is not set early enough, the editor will try to
load its theme files via the cache handler, which will fail.
fix(ckeditor): create a new input element was re-enabling other input fields

Added data-cke-init flag to distinguish between manually disabled ckeditors
and not yet initialized ones.
feature(amd): added some utils to Elgg_Amd_Config class

Utils are unsetPath, unsetShim and removeDependency.
fix(amd): removed elgg_require_js for backwards compatibility

Use elgg_load_js instead. Use elgg_register_js to define sync or async
javascript instead.

`elgg_register_js` manages registrations and loadings of async js better
`elgg_unregister_js` also unregisters async js
`elgg_load_js` also loads async js
Removed `elgg_require_js` function and uses
New private function `_elgg_get_external_file_from_map`

Fixes #6496