revset: add 'only' to DoS-safe symbols

There is no reason to disable it in hgweb because the same query can be
written without using 'only()'.

mercurial/revset.py

@@ -1798,6 +1798,7 b' safesymbols = set(['
     "min",
     "modifies",
     "obsolete",
+    "only",
     "origin",
     "outgoing",
     "p1",