SECURITY: Fix permissions check in action=rollback (CVE-2021-45038)

Because RollbackAction (as of 0a8403271109) overrided
FormAction::show(), it was no longer checking that the user had the
"rollback" userright. This restores that check, so people without the
"rollback" right will not be able to even get to the rollback form.

Then escape the user-supplied "from" parameter so it can't be used to
reveal the contents of other pages through transclusion, e.g.
"{{:Secret}}". wfEscapeWikiText() is also good practice for usernames in
general, as they can contain markup like bullets or single quotes that
affect output.

Bug: T297574
Change-Id: I7424f67f1217482b977f9617f0275c41fb94b60f