CVE-2013-6415: Escape the unit value provided to number_to_currency

Fixes CVE-2013-6415.

Previously the values were trusted blindly allowing for potential XSS attacks. 

This is different from the original upstream patch for 3.x:  return values from other number helper methods are not marked as `html_safe?`, so the html escaping always applies. This requires applications to explicitly call `.html_safe` on unit strings and number separators when calling `number_to_currency`.