Bugfix: escape input before appending it directly in the jQuery plugins.

At first this looks like XSS, but it isn't. The plugins (multitext, tags,
key/value, ...) were just using the raw input for building their elementlist.

If you entered XSS-like text it was just handled as HTML and append, and
therefore it look like it was XSS. But when it was saved to the database
Spoon handled the raw HTML correctly and escaped all special chars.

When the form was shown again the plugin builds the list again, and thus made
appended it directly and executed the XSS.
Updated changelog
Merge branch 'master' into xss

Conflicts:
	CHANGELOG.md