Do not allow HTML input

As of f1632cca1160eae2f6e3b2612e26aada5d203760 (and before 13ab01a4488e4e2f8d396e913fee00bdb46adf88), instance administrators can inject arbitrary HTML into an application.

If relative_urls is on, this allows instance administrators to trivially execute JavaScript in the installation's origin.
But even if it's off, instance administrators can trivially:

 * Steal users' session cookies (And vote as them in other instances!)
 * Out-right ask users for their passwords.
 * Switch out links to other parts of the UI

http://sectest.adhocracy.de/ demonstrates this (try clicking one of the navigation links).

Therefore, we should forbid HTML in instance and milestone texts. This pull request does exactly that.