CVE-2013-6415: Escape the unit value provided to number_to_currency

Fixes CVE-2013-6415.

Previously the values were trusted blindly allowing for potential XSS attacks. 

This is different from the original upstream patch for 3.x in that return values from other number helper methods are not marked as html_safe, so the html escaping always applies. This requires applications to explicitly set .html_safe on unit strings and number separators when calling number_to_currency.