Replace core's token help on admin/config/people/settings with token tree

Currently core outputs a hard-coded list of specific tokens, but since it runs the user e-mail text through token_replace() there are a lot more tokens supported than shown. We should replace this with a token tree UI so that it is more helpful to the user. We should also add validation on the token types.

On the more difficult side, there are two dangerous tokens that should be listed on these pages, but not normally elsewhere, user:cancel-url and user:one-time-login-url. We'll have to figure out how to get those tokens to display only on those specific token trees. We may have to add something like #tokens or #extra_tokens in theme_token_tree().