header.pl: Create new escape function that uses HTML::Entities.

This partly replaces cleanhtml(), which is kept for
backwards-compatibility and for a special case.
proxylog.dat: Escape usernames.

Bug #10406.
HTML-Template: New package.
redirect.cgi: Introduce a small template engine for the error pages.
urlfilter: Make redirect.cgi template selectable.
core73: Add redirection template engine.
core73: Add HTML::Template.
Merge remote-tracking branch 'ms/xss' into next
core73: Add changes files from #10406.