Do not allow HTML input

As of f1632cca1160eae2f6e3b2612e26aada5d203760 (and before 13ab01a4488e4e2f8d396e913fee00bdb46adf88), instance administrators can inject arbitrary HTML into an application.

If relative_urls is on, this allows instance administrators to trivially execute JavaScript in the installation's origin.
But even if it's off, instance administrators can trivially:

 * Steal users' session cookies (And vote as them in other instances!)
 * Out-right ask users for their passwords.
 * Switch out links to other parts of the UI

http://sectest.adhocracy.de/ demonstrates this (try clicking one of the navigation links).

Therefore, we should forbid HTML in instance and milestone texts. This commit does exactly that.
Make HTML rendering conditional upon an installation-wide configuration option