fix(security): Implements stronger remember me cookie strategy

This implements remember me tokens using a greater entropy pool,
replacing codes as users return to the site, and mitigating a
brute-force attack by introducing a delay when an invalid elggperm
cookie is given. For admins, the tokens are removed immediately.
fix(routing): prevent upgrade if .htaccess needs updating

The router relies on a querystring added via URL rewriting by
the web server. If missing, this would lead to looping redirects
or showing only the index page. This requires the URL rewriting
strategy to be in place before the upgrade can run.

Fixes #6521
feature(ux): Failed file uploads give better error messages.

Added elgg_get_friendly_upload_error() and associated language strings.

Fixes #6593.
fix(upgrade): Only running comment migration timestamp fix if comments exist.

Fixes #6621
Merge pull request #6622 from brettp/comments_migration_fix

fix(upgrade): Only running comment migration timestamp fix if comments e...
fix(views): rss w3c validation improvements
Merge pull request #6624 from beck24/rss-validation

fix(views): rss w3c validation improvements
Merged in remember_me (pull request #13)

Implements more secure remember me strategy for 1.8
Merge remote-tracking branch 'bb/1.8' into 1.8
fix(ui): Fixed ajax loader's ID attribute.
chore(release): Updated CHANGES.txt.
Merge branch '1.8'

Conflicts:
	CHANGES.txt
	actions/admin/user/resetpassword.php
	engine/lib/sessions.php
	engine/lib/users.php
	version.php
	views/rss/page/default.php
fix(core): Updated upgrade file for remember me cookies for 1.9's new table.

Fixes #6629.
fix(session): fixes remember me functionality broken in 1.8.19 merge

Due to the change in how remember me hashes are stored in 1.9, we must
change the strategy a bit to handle multiple hashes. This also cleans up
the cookie read/write.
chore(upgrades): small SQL style improvement
Merge pull request #6632 from mrclay/brettp-updated_cookies_upgrade1

Fixes remember me upgrade and functionality
chore(security): converts ElggCrypto to service

This makes these methods possible to override in unit tests.

Fixes #6635
Merge pull request #6637 from mrclay/6635

chore(security): converts ElggCrypto to service
Merge pull request #6522 from mrclay/6521

fix(routing): alert site owner if .htaccess needs updating
Merge pull request #6611 from brettp/better_upload_errors

feature(ux): Failed file uploads give better error messages.