feature(users): making nicer lost password process

1. User clicks "forgot password" and makes request
2. User receives via e-mail a URL to reset password
3. Accessing URL gives user a form to set her new password (uses temporary session bound to user account, but not logged in)
4. If password fields agree (and pass requirements), the password is set on the account, and the user is logged in.

There's just no need for the temporary password and forcing the user to login and change it.

Fixes #5886
chore(users): differentiating between user changing password and admin reset
security(users): making change password emails expire
chore(users): refactoring password reset action and function

Password reset action is using force_user_password_reset function.
The execute_new_password_request function sends the password by email
when it's generated randomly.
chore(output): add deprecation warning and update docs

Adds a deprecation warning for use of js attribute, updates docs with an example, removes the todo for style (support for this would require additional overhead for checking proper tokenization, whether or not style properties are closed with semicolon etc)
fix(security): Implements stronger remember me cookie strategy

This implements remember me tokens using a greater entropy pool,
replacing codes as users return to the site, and mitigating a
brute-force attack by introducing a delay when an invalid elggperm
cookie is given. For admins, the tokens are removed immediately.
fix(routing): prevent upgrade if .htaccess needs updating

The router relies on a querystring added via URL rewriting by
the web server. If missing, this would lead to looping redirects
or showing only the index page. This requires the URL rewriting
strategy to be in place before the upgrade can run.

Fixes #6521
chore(views): moved check to avoid an array index warning
chore(oauth): compatibility with OAuth PHP module
Merge pull request #6562 from sembrestels/warning-array-index

chore(views): moved check to avoid an array index warning
fix(router): better handles invalid cache requests

If a cache request doesn't match the pattern, we no longer
continue to march on into errors.

Fixes #6559
fix(menus): eliminates warnings in section menus

Handles case where $vars['items'] is empty/not an array.

Fixes #6558
Merge pull request #6567 from mrclay/6558

fix(menus): eliminates warnings in section menus
Merge pull request #6566 from mrclay/6559

fix(router): better handles invalid cache requests
Merge pull request #6565 from sembrestels/twitter-oauth

chore(oauth): compatibility with OAuth PHP module
fix(hhvm): hhvm compatibility

Reducing scrutinizer noise
fix(deprecated): fix container reference in getter function
fix(deprecated): fix incorrectly referenced variable
fix(deprecated): fix incorrectly referenced variable
fix(hhvm): hhvm compatibility

Reducing scrutinizer noise