[SECURITY] XSS in colorpicker wizard

Encode user-input in JavaScript context for colorpicker.

Change-Id: I0de44c590d5af304ef854628d6f5eab0c0b681ca
Fixes: #42772
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: b5174020f706f83457d681c6c4d4d6054d3aa961
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26193
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Prevent editor controlled hmac content

An hmac of the editor controlled auto respond message was used to verifiy
the correctness of this message on submit. To prevent this, we add an
additional secret.

Change-Id: I518f020af9a5cf0c66870c52aa5534938b1966cb
Fixes: #45043
Releases: 4.5, 4.7, 6.0, 6.1, 6.2
Security-Commit: f707a2013a15f005cb43765170d8dc6eae2e5a26
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26194
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader