Follow-up r64670 (bug22929): cleaner implementation of security for script (and poten...

Follow-up r64670 (bug22929): cleaner implementation of security for script (and potentially CSS) files.  ResourceLoader *already* knows where each module has come from, so all we need to do is filter them in OutputPage according to the desired level of 'trustworthiness'.

TODO:
* Are there instances where we might want to restrict CSS as well as JS?
* Would a $wg config option and/or user preference and/or index.php GET parameter to limit inclusion be useful?
* Can we deprecate any of the existing $wg config options?
* What's going on with the duplicated code between OutputPage and SkinTemplate?