[core] Fix some XSS vulnerabilities

Make Mako HTML escape all variable as default
EscapeJs javascript loaded in ko models and displayed as text (e.g. jobsub description,
Oozie action json parameters list)
Un-escape all the legitmate form fields
Adding some sanity checks