(CE-1075) Apply MediaWiki 1.19.20 security release

This applies the MediaWiki 1.19.20 security release which makes
OutputPage::disallowUserJs also disable user styles, so user supplied
CSS isn't run on secure pages.

Also disallow user JS/CSS on our own signup/login forms.
(CE-1075) Update MW version number and add release notes
(CE-1075) Make OutputPage::setAllowedModules set level explicitly

Make OutputPage::setAllowedModules set level explicitly rather than
getting the minimum. This is needed for a hook we use,
Wikia::onTitleGetSquidURLs.
Merge branch 'CE-1075' into dev