secure <metadata_raw>

currently, the raw metadata snippet is placed in the media file’s page in an
HTML commented <metadata_raw> tag. the concern is that the raw metadata may
contain a closing HTML comment tag. this patch handles this situation using
htmlspecialchars().

Change-Id: I0543fe92091efbb7e2dcf8301ca8b52367a2ac9f