Move the code for the suggested link to the view

This will make changing to escaping by default easier later.

It is also moving a view responsibility to the view.
Switch to Erubis

Like for like replacement. Erubis is also apparently faster than the
std lib Erb implementation. Rails >3 uses Erubis.
Escape by default in templates

This should make it hard to introduce an XSS vulnerability.

For example, before, if you had been able to get a malicious HTML or
JS value into one of the database fields we render, it would have been
rendered by the browser as HTML/JS, and provided an attack vector.

Escaping by default is the same behaviour as Rails >3, although the
implementation differs.
Merge pull request #29 from alphagov/escape_all_database_content_by_default

Escape all database content by default