Disable user scripts on Special:Preferences, to prevent a compromised

Disable user scripts on Special:Preferences, to prevent a compromised
script from being able to sniff passwords etc.

(The control flow here is hopelessly tangled between OutputPage and
the skins, and it doesn't help that Skin and SkinTemplate do things
differently for no particular reason.  I haven't made any attempt to
untangle it in this commit, but hopefully I at least haven't made it
too much worse.  Cleanup is welcome.)