mediawiki: multiple vulnerabilities

Two flaws were corrected in the recently-released MediaWiki 1.20.5 and 1.19.6 releases:

* Jan Schejbal / Hatforce.com reported that SVG script filtering could be bypassed for Chrome and Firefox clients by using an encoding that MediaWiki understood, but these browsers interpreted as UTF-8. [1]

* Internal review discovered that extensions were not given the opportunity to disable a password reset, which could lead to circumvention of two-factor authentication. [2]

[1] https://bugzilla.wikimedia.org/show_bug.cgi?id=47304
[2] https://bugzilla.wikimedia.org/show_bug.cgi?id=46590