Refactor locales code to store the currently chosen locale as
`_converse.locale` and use that in converse-notifications.js

- Fix event listener code examples
- Mention the preferability of using versions in the CDN

Only $.Deferred is still being used in converse-core.

Also update clean-css

Currently translated at 100.0% (267 of 267 strings)

Translation: Converse.js/Translations
Translate-URL: https://hosted.weblate.org/projects/conversejs/translations/af/

Translated using Weblate (Dutch)

Currently translated at 36.3% (97 of 267 strings)

Translation: Converse.js/Translations
Translate-URL: https://hosted.weblate.org/projects/conversejs/translations/nl/

Translated using Weblate (French)

Currently translated at 99.2% (265 of 267 strings)

Translation: Converse.js/Translations
Translate-URL: https://hosted.weblate.org/projects/conversejs/translations/fr/

Translated using Weblate (German)

Currently translated at 62.9% (168 of 267 strings)

Translation: Converse.js/Translations
Translate-URL: https://hosted.weblate.org/projects/conversejs/translations/de/

Not a security hole, but a UX issue.

Also... don't render artifacts before rendering the nickname form.

* unescape html characters in URL before checking whether it targets to image

* update docs/CHANGES.md

* test image's URL with query string which contains html-escaped characters

* utils.js: following code conventions

* split test url with query string to separate test

after rendering the registration form.

Updates #814