MimeMagic: Don't seek before BOF

This has weird side effects like only extracting the tail of the
file partially or not at all.

Bug: 66428
Change-Id: I182128c6958244f1515227ee742c3206a7484aee
(cherry picked from commit d96c6f01479efebb5c636cb1deeda43ff2deafdf)
SECURITY: Prevent external resources in SVG files

On bug 65724, it was discovered that a user could upload SVG images
with embedded <image> elements that pulled in the resource via http.
This could allow an attacker to track all viewers of an SVG by having
the image embed another image hosted on their own server.

While testing the patch, I also identified 3 more element namespaces
that have been used on commons and seem harmless, so I added those to
the whitelist.

Change-Id: I59a29d9eb76a1683ffa9c29cd9a94533f7bac4ce
Updated release notes and version number to 1.21.11

This is MediaWiki 1.21.11 security and maintenance release

Change-Id: I155c9f76a57dfe93506c029a8991759fd48723bd
Merge branch 'REL1_21' of https://gerrit.wikimedia.org/r/p/mediawiki/core into REL1_21
Merge branch 'REL1_21' into REL1_21_custom