Signed-off-by: Stefan Weil <sw@weilnetz.de>

As gluon-web uses standard multipart/form-data requests, browsers don't
enforce any cross-origin restrictions. To prevent malicious injection of
POST requests into the config mode, match the Origin header against the
Host header of the request.

Actually raise an error and turn it into an HTTP 400 return code when
something goes wrong, rather than ignoring the error.

We also improve the conditions under which errors are thrown before
pump() is called: We don't need to check for the multipart/form-data
content-type twice, and a POST without this content-type is now always
an error.

Having a trailing newline is nice when viewing the returned data in a
terminal.

This removes PKG_VERSION and PKG_RELEASE from most Makefiles, as the
value was never useful for Gluon packages; instead, PKG_VERSION is set
to 1 in gluon.mk.

It also removes two other weird definitions:

- gluon-iptables-clamp-mss-to-pmtu replicating the old PKG_VERSION logic
  from gluon-core, but without the fixed PKG_BUILD_DIR to prevent
  unnessary rebuilds
- gluon-hoodselector set GLUON_VERSION=3

The code is slightly cleaned up to fix compiler warnings.

None of our code uses cookies, so this issue went unnoticed.

Can be used for inserting Lua values into inline JS code.

- CGI script and index.html are moved from gluon-web to
  gluon-config-mode-core, the script is renamed to 'config'
- gluon-web and gluon-web-model base views and i18n files are symlinked
  into the new path
- gluon-web-theme is renamed to gluon-config-mode-theme and installs
  directly into the new path
- all gluon-web-* models, controllers and views are moved into the new
  path

Also bring back gluon-web-theme's i18n strings.

exec() is moved to gluon.util.

By emitting Lua code to call translate() and pcdata(), we are more
flexible than when doing this internally in the parser. The performance
penalty should be negligible.

We need a bit less escaping this way.