feature(users): making nicer lost password process

1. User clicks "forgot password" and makes request
2. User receives via e-mail a URL to reset password
3. Accessing URL gives user a form to set her new password (uses temporary session bound to user account, but not logged in)
4. If password fields agree (and pass requirements), the password is set on the account, and the user is logged in.

There's just no need for the temporary password and forcing the user to login and change it.

Fixes #5886
chore(users): differentiating between user changing password and admin reset
security(users): making change password emails expire
chore(users): refactoring password reset action and function

Password reset action is using force_user_password_reset function.
The execute_new_password_request function sends the password by email
when it's generated randomly.
chore(output): add deprecation warning and update docs

Adds a deprecation warning for use of js attribute, updates docs with an example, removes the todo for style (support for this would require additional overhead for checking proper tokenization, whether or not style properties are closed with semicolon etc)
chore(views): moved check to avoid an array index warning
chore(oauth): compatibility with OAuth PHP module
Merge pull request #6562 from sembrestels/warning-array-index

chore(views): moved check to avoid an array index warning
fix(router): better handles invalid cache requests

If a cache request doesn't match the pattern, we no longer
continue to march on into errors.

Fixes #6559
fix(menus): eliminates warnings in section menus

Handles case where $vars['items'] is empty/not an array.

Fixes #6558
Merge pull request #6567 from mrclay/6558

fix(menus): eliminates warnings in section menus
Merge pull request #6566 from mrclay/6559

fix(router): better handles invalid cache requests
Merge pull request #6565 from sembrestels/twitter-oauth

chore(oauth): compatibility with OAuth PHP module
fix(hhvm): hhvm compatibility

Reducing scrutinizer noise
fix(deprecated): fix container reference in getter function
fix(deprecated): fix incorrectly referenced variable
fix(deprecated): fix incorrectly referenced variable
fix(hhvm): hhvm compatibility

Reducing scrutinizer noise
fix(output): terminate attribute formatting early if attributes are not set

Reduce noise in logs by terminating elgg_format_attributes() early

Refs #6458
fix(views): use api to format ajax loader attributes

Reduce noise in logs by declaring variables and using elgg_format_attributes()

Refs #6458