Better XSS protection

* Add HTMLPurifier library (LGPL)
* Add helper functions to html helper
* Set default encoding header to UTF-8
* Make sure the doctype is the same everywhere (admin/members/frontend)
* Remove use of strip_tags() and htmlspecialchars()
* Replace vanilla htmlentities with html::escape() - make sure no one forgets the UTF-8
* Remove _csv_text() fn - no longer used and was using strip_tags()

Conflicts:

	application/controllers/admin/reports.php
	application/helpers/category.php
	application/hooks/actions.php
	application/libraries/VideoEmbed.php
	application/libraries/XMLImporter.php
	application/views/admin/manage/actions/main.php
	application/views/admin/manage/categories/main.php
	application/views/header_nav.php
	plugins/sharing/controllers/json/share.php
	themes/default/views/header.php
	themes/default/views/main/layout.php
	themes/default/views/reports/detail.php
	themes/default/views/reports/list.php
	themes/unicorn/views/main/layout.php
html::clean() : Make allowed tags and iframes configurable

Conflicts:

	application/config/config.template.php
Fix double escaping and missing library after merge of #1056

Conflicts:

	themes/default/views/reports/list.php
Set default values for allowed html and iframesi #1056

This avoids errors if upgraders don't update config.php