Fixes potential XSS at any page containing grid.

Every site, containing datagrids, can be hacked, using simple XSS, leading to
cookies leak.

To reproduce the problem, go to any site, wich uses djblets.datagrid. For
example, open http://demo.reviewboard.org/r/ Now add
?111'%3balert(document.cookie)//222=1 to the end of the URL and load that page.
That is the way, how a cookie thief will prepare the URL for his victim.
Then click to any table's header and you'll see an alert box with all your
cookies.

Reviewed at http://reviews.reviewboard.org/r/3658/
Show traceback if there was error during datagrid rendering.

Sometimes errors occur in the field rendering code, and in that case the
datagrid renders to an empty html. This patch allows to see a traceback of the
error instead. during datagrid rendering.
Fix CounterField initialization

CounterField's _reinit method was returning back control if the pk of the model
wasnt setup yet. This caused any of the "initializers" to not fire for the very
first time. Modified the logic so that control returns back if the model's pk is
None and there are no initializers defined. The earlier fix
(https://github.com/djblets/djblets/commit/5f38334fabfd282232908ef80b28cd1889d0871c#djblets/util/fields.py)
was setting the value to 0 if the pk wasnt available at the time. I've modified
the logic so that the method _reinit returns back immediately (without
processing the counter value) only if the pk is none and there are no
initializers defined. For the case of LocalSiteProfiles table, there are
initializers defined for all CounterFields, so they would be initialized the
first time the object is created.

With this fix, there is still a problem in calculating counts on the
LocalSiteProfiles for starred_public_request_counts. This is fixed in review
request #3842 (http://reviews.reviewboard.org/r/3842/)

Testing done:
Manual testing with regular and creating local sites and ensured that the first
time was seeing counts rather than None. Ran all reviewboard tests.

Fixes part of bug 2873.
Reviewed at http://reviews.reviewboard.org/r/3841/
Release Djblets 0.6.28.
Actually release now.
Bump to 0.6.29 dev.
Escape field values in datagrid cells.

Datagrid cells would pull data from a model and render it as-is. This
could lead to issues when using certain characters. We now escape
everything coming from the database.

If a custom renderer is provided, it's still expected that it returns
valid, safe HTML.