Fix possible XSS issue in frames anchor handling.

frames.html can parse the anchor in the address bar for a string
starting with "#!" that tells YARD which main frame to load. The
string parsed from the anchor was not sanitized, allowing for any
arbitrary HTML to be embedded into the page.

However, due to the HTML4 specification, HTML is not allowed inside
of a <frameset> tag, and any compliant browser should drop any such
markup from the DOM, negating a possible attack vector. It is still
possible to embed HTML inside of a <noframes> element, but very few
modern browsers will handle such a tag anyway. Given these factors,
the impact of such an XSS attack is very low.