Configure allowed content types of textblock text field

- Add validator and use `text/x-html-safe` output format for preventing XSS
- Use only `text/html` as allowable content types, so that the format is not selectable in the WYSIWYG field

/cc @maethu