feature(users): making nicer lost password process

1. User clicks "forgot password" and makes request
2. User receives via e-mail a URL to reset password
3. Accessing URL gives user a form to set her new password (uses temporary session bound to user account, but not logged in)
4. If password fields agree (and pass requirements), the password is set on the account, and the user is logged in.

There's just no need for the temporary password and forcing the user to login and change it.

Fixes #5886
chore(users): differentiating between user changing password and admin reset
security(users): making change password emails expire
chore(users): refactoring password reset action and function

Password reset action is using force_user_password_reset function.
The execute_new_password_request function sends the password by email
when it's generated randomly.
chore(output): add deprecation warning and update docs

Adds a deprecation warning for use of js attribute, updates docs with an example, removes the todo for style (support for this would require additional overhead for checking proper tokenization, whether or not style properties are closed with semicolon etc)
fix(core): Not redirecting in plugin and site entity views.

This redirect is infuriating to encounter if you pass invalid options to ege() and wind up on the index page for no apparent reason.

Fixes #4439.
chore(views): moved check to avoid an array index warning
chore(oauth): compatibility with OAuth PHP module
Merge pull request #6562 from sembrestels/warning-array-index

chore(views): moved check to avoid an array index warning
fix(router): better handles invalid cache requests

If a cache request doesn't match the pattern, we no longer
continue to march on into errors.

Fixes #6559
fix(menus): eliminates warnings in section menus

Handles case where $vars['items'] is empty/not an array.

Fixes #6558
Merge pull request #6567 from mrclay/6558

fix(menus): eliminates warnings in section menus
Merge pull request #6566 from mrclay/6559

fix(router): better handles invalid cache requests
Merge pull request #6565 from sembrestels/twitter-oauth

chore(oauth): compatibility with OAuth PHP module
fix(ckeditor): makes sure basepath is set early enough

If CKEDITOR_BASEPATH is not set early enough, the editor will try to
load its theme files via the cache handler, which will fail.
fix(ckeditor): create a new input element was re-enabling other input fields

Added data-cke-init flag to distinguish between manually disabled ckeditors
and not yet initialized ones.
feature(amd): added some utils to Elgg_Amd_Config class

Utils are unsetPath, unsetShim and removeDependency.
fix(amd): removed elgg_require_js for backwards compatibility

Use elgg_load_js instead. Use elgg_register_js to define sync or async
javascript instead.

`elgg_register_js` manages registrations and loadings of async js better
`elgg_unregister_js` also unregisters async js
`elgg_load_js` also loads async js
Removed `elgg_require_js` function and uses
New private function `_elgg_get_external_file_from_map`

Fixes #6496
chore(amd): added tests for AMD module registering and loading
fix(hhvm): hhvm compatibility

Reducing scrutinizer noise