feature(users): making nicer lost password process

1. User clicks "forgot password" and makes request
2. User receives via e-mail a URL to reset password
3. Accessing URL gives user a form to set her new password (uses temporary session bound to user account, but not logged in)
4. If password fields agree (and pass requirements), the password is set on the account, and the user is logged in.

There's just no need for the temporary password and forcing the user to login and change it.

Fixes #5886
chore(users): differentiating between user changing password and admin reset
security(users): making change password emails expire
feature(views): bypasses minification for views like -min/.min

JSMin sometimes cannot handle scripts that have already been minified
by other compressors. This bypasses compression if the view name
suggests it's already compressed.

Fixes #6260
docs(autoloader): more accurate docs for autoloader

Gives a more accurate picture of methods on the autoload manager
and the overall strategy of elgg_register_classes().
chore(users): refactoring password reset action and function

Password reset action is using force_user_password_reset function.
The execute_new_password_request function sends the password by email
when it's generated randomly.
fix(security): Implements stronger remember me cookie strategy

This implements remember me tokens using a greater entropy pool,
replacing codes as users return to the site, and mitigating a
brute-force attack by introducing a delay when an invalid elggperm
cookie is given. For admins, the tokens are removed immediately.
fix(routing): prevent upgrade if .htaccess needs updating

The router relies on a querystring added via URL rewriting by
the web server. If missing, this would lead to looping redirects
or showing only the index page. This requires the URL rewriting
strategy to be in place before the upgrade can run.

Fixes #6521
fix(ux): Server-side validation for email fields in profile edit action.
chore(users): logs the user in after a successful password reset
fix(aalborg_theme): standardize padding on input and a buttons

Follow-up of #6591
chore(vendors): Updated and minified jQuery Form

Upgraded jQuery Form to 3.50.

Fixes #6601
feature(admin): Admin notices are removed when the actions requested actions has been taken.

Fixes #6453
chore(htmlawed): Added more comprehensive tests for HTMLawed.

Fixes #6297
Merge pull request #6437 from sembrestels/reset-password

Forgot password made nicer
Merge pull request #6598 from brettp/htmlawed_tests

chore(htmlawed): Added more comprehensive tests for HTMLawed.
Merge branch '1.8'

Conflicts:
	mod/htmlawed/tests/tags.php
fix(htmlawed): Setting the params argument to a defaut of null in htmlawed_filter_tags().

Fixes #6614.
Merge pull request #6615 from brettp/htmlawed_filter_tags_param

fix(htmlawed): Setting the params argument to a defaut of null in htmlawed_filter_tags().
Merge pull request #6608 from brettp/admin_notices

feature(admin): Admin notices are removed when the actions requested actions has been taken.