Special:Search: Remove token from URL when saving settings

When JS is enabled, use POST/Redirect/GET to make unintentional
setting changes less likely. (Otherwise, we have to use GET to avoid
breaking things such as Firefox's "Add a Keyword for this Search",
though we can still redirect.)

Also use the checkbox field for the token so the token is only sent
when saving settings (and not shown otherwise).

Bug: 68827
Change-Id: I869e554d2a207ff06e2f8d9667752111e2fa2ea1
Merge "Special:Search: Remove token from URL when saving settings"