Shop item: use text/x-html-safe output format and only allow text/html input.

- Add validator and use `text/x-html-safe` output format for preventing XSS
- Use only `text/html` as allowable content types, so that the format is not selectable in the WYSIWYG field

/cc @maethu