Fix for XSS issue in bug 66608

Generate the URL used for loading a new page in Javascript,
instead of relying on the URL in the link that has been clicked
(as that could have been crafted by an attacker).

Bug: 66608
Change-Id: I19e2bf3af017a37c35cbadce9a70194aac693f33
SECURITY: Copy prevent-clickjacking between OutputPage and ParserOutput

Special page transclusion returns an OutputPage, whose metadata is
copied into the ParserOutput, and then later back into an OutputPage.
The "preventClickjacking" flag should be part of that metadata.

Bug: 65778
Change-Id: I17d2720fb94bb383a92059e5adbf6c16ee3e9ef4