Fix XSS vulnerabilities in screenshot captions and branches.

Screenshot captions and the branch field were marking strings as safe
that shouldn't have been safe.

In the case of screenshots, this was unintentional due to marking the
"<img/>" as safe (since we needed it to appear as a real image tag). The
alt attribute was set to the caption, and that wasn't being escaped in
these two cases (though it was set properly for comments).

For branches, this was a holdover from the very early days and was due
to an entity one of the early SCMTool specializations was setting in
that field. It's now escaped properly, and the SCMTool is passing the
character it wants and not the entity.

These vulnerabilities were discovered by Frederik Braun at Mozilla.
Release Review Board 1.6.21.
Fix XSS vulnerabilities in screenshot/attachment captions and branches.

Screenshot and image attachment captions and the branch field were
marking strings as safe that shouldn't have been safe.

In the case of screenshots and image attachments, this was unintentional
due to marking the "<img/>" as safe (since we needed it to appear as a
real image tag). The alt attribute was set to the caption, and that
wasn't being escaped in these two cases (though it was set properly for
comments).

For branches, this was a holdover from the very early days and was due
to an entity one of the early SCMTool specializations was setting in
that field. It's now escaped properly, and the SCMTool is passing the
character it wants and not the entity.

These vulnerabilities were discovered by Frederik Braun at Mozilla.
Turn on the X-Frame-Options header for clickjacking prevention.

Django provides middleware to turn on the X-Frame-Options header, which
hints to the browsers (those that support it) to prevent loading if
inside a frame (in our case, in any frame not from the same origin).
This will be the default for new Django projects in 1.6, but worth
turning it on here.

This is not a security vulnerability. Rather, this is just extra
hardening, for the browsers that choose to support this header.
Merge branch 'release-1.6.x' into release-1.7.x
Release Review Board 1.7.17.