PostgreSQL: decode image.img_metadata

The img_metadata field was not being decoded from bytea into text.

This change to core fixes the reported problem with PdfHandler against
1.22.6, origin/REL1_23 and git head.

Bug: 59147
Change-Id: I285a317a57a29713af1f7f630b340278bd5400da
(cherry picked from commit 8c62609dc877b6ed687e9a3835cfc24fb87e5be2)
Merge "PostgreSQL: decode image.img_metadata" into REL1_22
SECURITY: Prepend jsonp callback with comment

Mitigate CVE-2014-4671 for unpatched flash players

Bug: 68187
Change-Id: I2f46e623c1f541dbbafb6e8333e0929055098b15
Fix for XSS issue in bug 66608

Generate the URL used for loading a new page in Javascript,
instead of relying on the URL in the link that has been clicked
(as that could have been crafted by an attacker).

Bug: 66608
Change-Id: I19e2bf3af017a37c35cbadce9a70194aac693f33
SECURITY: Copy prevent-clickjacking between OutputPage and ParserOutput

Special page transclusion returns an OutputPage, whose metadata is
copied into the ParserOutput, and then later back into an OutputPage.
The "preventClickjacking" flag should be part of that metadata.

Bug: 65778
Change-Id: I17d2720fb94bb383a92059e5adbf6c16ee3e9ef4
Updated release notes and version number to MediaWiki 1.22.9

This is MediaWiki 1.22.9 security and maintenance release.

Change-Id: Idec425d29f7117d7d3166e50cab55b640722a73f
Merge branch 'REL1_22' of https://gerrit.wikimedia.org/r/p/mediawiki/core into REL1_22