Fix XSS vulnerabilities in screenshot captions and branches.

Screenshot captions and the branch field were marking strings as safe
that shouldn't have been safe.

In the case of screenshots, this was unintentional due to marking the
"<img/>" as safe (since we needed it to appear as a real image tag). The
alt attribute was set to the caption, and that wasn't being escaped in
these two cases (though it was set properly for comments).

For branches, this was a holdover from the very early days and was due
to an entity one of the early SCMTool specializations was setting in
that field. It's now escaped properly, and the SCMTool is passing the
character it wants and not the entity.

These vulnerabilities were discovered by Frederik Braun at Mozilla.
Release Review Board 1.6.21.