SECURITY: OutputPage: Remove separation of css and js module allowance

* No longer segment module origin allowance by an "only=" content
type. Both can be sensitive security-wise and there's no valid
use case for allowing CSS anywhere you want to disallow JS. Both
can significantly impact the user interface and cause unintended
actions to be taken on the user's behalf, or desired actions to
be made practically impossible.

* While at it, also remove the ability to set the module allowance
directly. The reduceAllowedModuleOrigin method is all we need.
I couldn't find usage or mention of setAllowedModules() in
mediawiki-core nor in any other Wikimedia-hosted repository.

Bug: 70672
Change-Id: I0e82755aede6ddd7101b495802a45d5fd96b6722
Updated release notes and version number for MediaWiki 1.23.5

This is MediaWiki 1.23.5 security release

Change-Id: Id27a11a4061b8b1c6c014ca86e77cc1cd028613b
Merge branch 'REL1_23' of https://gerrit.wikimedia.org/r/p/mediawiki/core into REL1_23
Merge branch 'REL1_23' into REL1_23_custom