XSS escaping

Integrated the monkey-patches from the rails_xss plugin, using more performant code from rails master where possible.

Notable changes:

- `url_for` no longer does any escaping
- removed rails usage of `escape_once`
- html escaping now includes `'` by default
- generated Erubis templates have fewer method calls
- removed `String#html_safe!` hacks
- upstream versions of `ActiveSupport::SafeBuffer` and `ActionView::OutputBuffer`

/cc @github/rails