Fix security/general concerns

I skipped two concerns, namely

• "threed" as being confused with "thread" is probably not worth fixing now
• three.js is unwieldy, but I'm not sure there's a "good" way to fix that

Also added a new config, $wgMax3d2pngMemory, that should be set high to avoid
unnecessary failures.

Bug: T157077
Change-Id: Ifc716148ae40e87c8e9d5b650e069dee9e09d43d