Make Padrino::Rendering use ActiveSupport::SafeBuffer

This change switches all rendering to use SafeBuffer instead of a raw string.

SafeBuffer is a Subclass of String, so concats and instantiations are cheap.

Concatenating SafeBuffer with a normal String escapes the String. Concatenating
SafeBuffer with another SafeBuffer keeps both intact.

This change requires to extensions: a special template implementation for
Erubis and a port of the XssMods used in HAML. At least the latter can be
dropped once HAML makes them available as a standalone.

All strings returned from #render are considered escaped. Strings can be
marked safe for concatenation using String#html_safe, which turns returns the
String as a SafeBuffer.
Port padrino helpers over to SafeBuffers

This patch ports all helpers over to use SafeBuffers. The changes
follow one general rule: all tag helpers like tag and content_tag
escape everything by default while block helpers like content_for
and form_for assume that the given content is already escaped.

Adds two new methods: safe_content_tag (which assumes that content
is already safe) and mark_safe, which marks a given String or Array
as safe.

Fixes test applications where necessary.
Add a test case for issue 936
Explicit braces to allow appending of numbers
Add test case for image_tags in link_tos
Temporarily use private HAML fork with patches
Use the public url for the private fork...
Merge remote-tracking branch 'origin/master' into safebuffer
Split #registered and #included in Rendering

Were used as synonyms, but including might not give you an app to
set settings on.
Fixes content_tag for ruby 1.8.7

String implements each...
Merge pull request #1031 from skade/safebuffer

Rendering using Safebuffer