TRUNK-3931 wrapping unescaped ${statement} outputs in <c:out ... />

this seems to fix jira issue #3931 ( https://tickets.openmrs.org/browse/TRUNK-3931 )

```
The create patient flow is allows stored XSS when using the following
name (script is executed when loading mdrtbEditPatient.form, and
potentially other pages that display the patient name).
"><script>alert("xss")</script>
...
```