SECURITY: OutputPage: Remove separation of css and js module allowance

* No longer segment module origin allowance by an "only=" content
type. Both can be sensitive security-wise and there's no valid
use case for allowing CSS anywhere you want to disallow JS. Both
can significantly impact the user interface and cause unintended
actions to be taken on the user's behalf, or desired actions to
be made practically impossible.

* While at it, also remove the ability to set the module allowance
directly. The reduceAllowedModuleOrigin method is all we need.
I couldn't find usage or mention of setAllowedModules() in
mediawiki-core nor in any other Wikimedia-hosted repository.

Bug: 70672
Change-Id: I850395bcf1268d0436f6b1fd37ec0bc16dcfd655
Updated release notes and version number for MediaWiki 1.22.12

This is MediaWiki 1.22.12 security release

Change-Id: I41b5d0ca053d1fe620d551e85960708a58415512
Merge branch 'REL1_22' of https://gerrit.wikimedia.org/r/p/mediawiki/core into REL1_22
Merge branch 'REL1_22' into REL1_22_custom