Fix a script injection attack in diff fragments.

When rendering a diff fragment, the user-specified 'index' value was not
checked for malicious/incorrect content, and was then directly embedded
straight into the page. This allowed an attacker to craft a URL with
custom HTML and pass it to another user (such as through an iframe),
running the custom code in their session.

The fix is simple. We just want to make sure that the index value
specified is a valid integer, and disregard it if not.

This vulnerability was found by Uchida.

Reviewed at https://reviews.reviewboard.org/r/6126/
Add access checks for the original/patched file resources.

The original/patched file resources weren't checking whether the user
had access to the review request. This allowed users to access the
original or patched file content of private review requests, if they
happened to know the relevant database IDs.

This mirrors the changes made to 2.0.x, with the exception that in
1.7.x, there are no draft versions of these resources.

Reviewed at https://reviews.reviewboard.org/r/6127/
Switch all references to reviewboard.org to use https.

This updates all the references to reviewboard.org to use https:// and
not http://. Most of these aren't very important, but some (such as
release.py) are necessary.

Reviewed at https://reviews.reviewboard.org/r/6128/
Release Review Board 1.7.27.