haml_tag, haml_concat and XSS

I’ve had a look at how `haml_tag` and `haml_concat` are interacting with XSS (See #718, #731, #732) and come up with this, which could do with a review.

I’ve created a new internal method to allow `haml_tag` to have better direct control of its output so it doesn’t need to rely on the rather crude `with_raw_haml_concat` method. I’ve left that method in (and kept `haml_concat` respecting it) as although it didn’t seem to be used anywhere else, and wasn’t well documented or tested, it is part of the public API so I don’t think we should remove it.