SECURITY: Make token comparison constant time

It seems like our token comparison would be vulnerable to timing
attacks. This will take constant time.

Bug: 61346
Change-Id: I2a9e89120f7092015495e638c6fa9f67adc9b84f
(cherry picked from commit 74ce391e9c115320e74c06772ee4fcb610ae33c4)
SECURITY: API: Don't find links in the middle of api.php links

Bug: 61362
Change-Id: Idf985e4e69c2f11778a8a90503914678441cb3fb
(cherry picked from commit 55cd620157d884af855459f1f7903b0427c992ce)
SECURITY: Disallow non-whitelisted namespaces

Disallow uploading non-whitelisted namespaces. Also disallow iframe
elements.

User will get an error including the namespace name if they use a non-
whitelisted namespace.

Bug: 60771
Change-Id: Id5c022543184b19b77ad32d9a8a0c2dbbc5e9038
Merge "SECURITY: Disallow non-whitelisted namespaces" into REL1_21
Merge "SECURITY: Make token comparison constant time" into REL1_21
Updated Release notes and version number for 1.21.6

This is MW1.21.6 security release

Change-Id: I03be84667f06b7b311ddf47a17ff58817f469f13
Updated Release notes

Release notes are now readable without the context of the bug. Also
removed whitespace

Change-Id: I699a10effd7a5b1fad25b70b2b69ffc2bae133f6
Merge branch 'REL1_21' of https://gerrit.wikimedia.org/r/p/mediawiki/core into REL1_21