Rendering using Safebuffer

This pull request ports the whole rendering stack to using `ActiveSupport::SafeBuffer`. This should prevent XSS problems described in #936 and #987.

Sadly, it contains 2 extensions to erubis and HAML.

The erubis extension is well within the bounds of the libraries API on the erubis side of things and is similar to the way Rails handles these things. Sadly, it requires a tiny hack to work with tilt 1.3.3 and its twisted template compilation - considering that Tilt hasn't been released since 2011, I see no quick fix there.
It also means that pure `erb` cannot be used with safe_buffer - this should not break, but the escaping might not work. I wouldn't recommend supporting multiple erb libraries anyways and erubis is the modern option.

The HAML extension is necessary, as the modifications handling SafeBuffer shipped with HAML mainline can only be loaded when ActionView is present. I will lobby with the HAML team to make them available standalone, they are a simple copy.

Slim works out of the box, as "=" is it escapes by default anyways.

Both need a set of default options, which is now supplied.

All helpers are ported and the tests run. The general rule is: structural helpers (content_for, form_for, etc.) and rendering helpers always assume their content to be escaped while code generating helpers (content_tag, tag) assume that all values need to be escaped.

I took the liberty of hiding an easteregg for @postmodern in the core test suite.

See the commit messages for details.