feature(settings): adds setting for default number of items per page

Most queries that default to 10 now use the setting, whose valid range
is, for now, 2 to 5000. In order to keep this simple, queries that
default to 20 items will continue showing at least 20 items; the setting
is used only if it’s greater than 20.

Fixes #2650
security(tokens): adds HMAC API and improves token-based security

Uses HMAC and constant-time string comparison for tokens in actions,
friend invites, password resets, and email validation.
fix(river): allow everyone to look at everyones activity page

fixes #6116
fix(db): elgg_get_metastring_id should always create an id

fixes #7579
Merge pull request #7616 from jdalsem/activity-for-everyone

fix(river): allow everyone to look at everyones activity page
chore(cache): simplifies MemoryPool by not proxying a Stash cache
Merge pull request #7604 from mrclay/lighter_pool

chore(cache): simplifies MemoryPool by not proxying a Stash cache
Merge pull request #7598 from mrclay/default_limit_110

feature(settings): adds setting for default number of items per page
fix(search): respect entity type/subtype instead of params type/subtype

In the default search result listing the entity view was determined
based on the search params. If however you return different type/subtype
entities those couldn't get their own search entity views.
Merge pull request #7590 from jdalsem/metastring-id-fix

fix(db): elgg_get_metastring_id should always create and id
fix(discussion): also search in discussion replies when searching
discussion topics

There was no way to search in the discussion replies, which limited the
discussion search results.

fixes: #7168
Merge pull request #7618 from jeabakker/search-discussion-replies

fix(discussion): also search in discusson replies when searching discussion topics
fix(groups): replaced deprecated entity loading with new method

fixes #7617
Merge pull request #7628 from jdalsem/group-edit-deprecation-fix

fix(groups): replaced deprecated entity loading with new method
Merge pull request #7597 from mrclay/5368_110

security(tokens): adds HMAC API and improves token-based security
fix(entities): system files removed for all entities on delete

Fixes #7130
Merge pull request #7636 from beck24/7130-files-delete

fix(entities): system files removed for all entities on delete
fix(annotations): do not enforce callback in egefac()

Allow custom or no callback in Annotations::getEntitiesFromCalculation()

Fixes #7398
fix(metastrings): cast metastring calculation to an integer

egefac() with count => true was returning a string, which was not in line with the documentation and general ege* pattern
fix(annotations): fixes egefac() count shortcut

Passing count => true to egefac() makes ege* logic identitical to a normal elgg_get_entities_from_annotations().

Fixes #4393