GUI-601: Prevent XSS attack vectors via tags

by escaping tags via Python's markupsafe.escape().  Converts building the instance choices in the Attach Volume to Instance dialog on the volumes landing/detail pages from the unsafe element.html(…) approach to Angular's ng-options.

Fixes https://eucalyptus.atlassian.net/browse/GUI-601