Do a better job of escaping text in commentcounts tag.

If a user set their full name to include </script>, they could cause some
problems. Most of this was fixed in Djblets 0.7.30 and 0.8.3, but the
commentcounts tag in Review Board 1.7.x didn't use json_dumps, and therefore
still had the problem.

This change adds some more escaping for different parts of the commentcounts
structure that gets serialized.

Testing done:
* Tested the view_diff.html template.
* Ran unit tests

Reviewed at https://reviews.reviewboard.org/r/5955/
Add draft release notes for 1.7.26

This adds draft release notes for the bug fixes, security fixes, and one new
feature since 1.7.25.

Testing done: Built HTML docs.

Reviewed at https://reviews.reviewboard.org/r/5956/
Require Djblets 0.7.30.

This contains security fixes needed for json_dumps and gravatars.
Release Review Board 1.7.26.
Escape some more usernames and real names.

This change escapes a few more instances of usernames and real names which get
dumped into json code that gets executed.

Testing done: Ran unit tests.

Reviewed at https://reviews.reviewboard.org/r/5968/
Merge branch 'release-1.7.x' into release-2.0.x