Fixes #683

Search results on the client interface for knowledgebase articles would
previous show hits for the internal (private) knowledgebase articles. The
subjects were shown but the articles were not viewable.

This addresses the SQL logic issue causing the private hits to be shown.

Also raise awareness of the hosted platform for osTicket

Also include
  * username validation -- no spaces or weird chars
  * no longer base64 encoded sha1-hex hash for CSRF token
  * refresh login page every two hours to keep session active

The email filtering feature supports a 'Use Reply-To' feature, but seems to
never have been implemented. This patch officially supports using the
Reply-To email header as the From header for emails matching the filter.

If an attachment is submitted via the API and the filetype is rejected, the
file would be attached anyway. However, if the file was encoded base64, the
content would not be decoded.

And ensure that the email address is trimmed to help matching against email
registered for previous tickets.

Anything that would happen after the last patch was applied would never be
logged, because the system would immediately indicate that no upgrade was
pending.

Fixes #575

Fixes #588

Introduced with the multi-stream upgrader

Drop old mcrypt class

Which will help against clobbering session cookies against other PHP
applications shared on a parent domain of the domain hosting osTicket or in
a parent folder or virtual folder.

* Move migration scripted tasks to the stream folder naming them .task.php.
* Add a MigrationTask abstract class to server as the base of migration
  tasks.
* Move the migration tasks from class.upgrader to the new task files

Add cipher validator - checks to make sure the cipher is valid & available.

Only use 8 bytes (64-bits) for the IV data (salt) for the encryption keys,
except for Mcrypt, which requires you to query the specific length and use
it specifically.

Add test function - basic testing (will be replaced by real test suit)

Incoming messages with empty body and an inline attachment might not have
parts - depending on encoding used.

* Use "-" tag for emails with empty body/message