MimeMagic: Don't seek before BOF

This has weird side effects like only extracting the tail of the
file partially or not at all.

Cherry-picked from d96c6f01479ef

Bug: 66428
Change-Id: I182128c6958244f1515227ee742c3206a7484aee
SECURITY: Prevent external resources in SVG files

On bug 65724, it was discovered that a user could upload SVG images
with embedded <image> elements that pulled in the resource via http.
This could allow an attacker to track all viewers of an SVG by having
the image embed another image hosted on their own server.

While testing the patch, I also identified 3 more element namespaces
that have been used on commons and seem harmless, so I added those to
the whitelist.

Change-Id: Iacc5d3d6248b73740510ba579be9484f4964ca13
Updated release notes and version number to 1.22.8

This is MediaWiki 1.22.8 security and maintenance release.

Change-Id: Id7218756acbac1ca26a788a1a92f9907c4432fde
Merge branch 'REL1_22' of https://gerrit.wikimedia.org/r/p/mediawiki/core into REL1_22
Merge branch 'REL1_22' into REL1_22_custom