Fix typo in Release Notes

Change-Id: I5b9728f3c4ce2bf53b06f2d5d0121205ccb4d5b2
SECURITY: Fix RevDel log entry information leaks

DELETED_ACTION is supposed to hide the target of the log entry. But a
few places weren't doing this properly.

This fixes:
* API list=logevents no longer returns the pageid when the target is
  hidden.
* Enhanced RecentChanges no longer includes the log target page in the
  CSS class. This should also make the CSS class actually useful.
* Watchlist no longer shows log entries with DELETED_ACTION unless the
  user has deletedhistory, and with SUPPRESSED_ACTION unless the user
  has suppressrevision.

Bug: 58699
Change-Id: I28e8b38a3204f29d83a4ae30c237abada79e1b1f
SECURITY: Return error on invalid XML for SVGs

Return an error from UploadBase::detectScriptInSvg when the svg has
XML that cannot be parsed. Usually the XML is invalid, or the parser has
run out of memory trying to parse the file.

This patch is rebased on top of bug 57550.

Bug: 58553
Change-Id: I1e84deb09be39d82e8e577f33bd655e9653e9a4b
SECURITY: Disallow -o-link in styles

Opera will execute javascript from -o-link css attributes.

Bug: 58472
Change-Id: I72ad1a0d7e6f9e3d5f51a46c3e4d8a428051de2e
SECURITY: Don't normalize U+FF3C to \

Bug: 58088
Change-Id: If2494d2beca3fff8e3b855a95dee9b35bfda4b03
SECURITY: Disallow stylesheets in svg

Bug: 57550
Change-Id: I114d040314be6c31ec1f7dbbba0b6760e95b3f86
Update Releasenotes and version number for 1.21.4

Change-Id: I941730963b7546ddc8cf0d2a9ca4c2c4aa939b8c
SECURITY: Sanitize shell command args

Add validation and sanitization to several code paths.

Bug: 60339
Change-Id: Id124281d21ec730a2e0bbace843dd97194a712b4
Update release notes and version number

Change-Id: I7bb1d944c963dffdb29b96d0dbe64f9a905394f7