Escape content before going into google-code-prettify.

marked.js passes raw text, not escaped text, to google-code-prettify.
This results in google-code-prettify highlighting content and otherwise
providing passed text as-is. This causes problems if you have any code
you're trying to highlight that looks like HTML, as it remains HTML.
Of course, this also means that HTML can be injected, leading to
attacks.

We now escape what marked.js gives us, and pass it to
google-code-prettify, which handles escaped content just fine.
Add release notes for 2.0 beta 1

This change adds release notes for almost everything that's gone into the master
branch so far. There are a few things that are intentionally left out because
they're not ready for user consumption.

Testing done: Built releasenotes docs and checked it out.
Reviewed at https://reviews.reviewboard.org/r/4861/