Expect sfOutputEscaper in QubitRoute
Expect sfOutputEscaper in QubitAcl::check
Checking properties of in escaped ES docs
Use $sf_data->getRaw(...) when needed

There are places where the way the code is written just don't work with escaped
objects. For example, getAll() in a parameter holder does not return an array
anymore but an object that implements ArrayAccess. We use the + operator to
append that to another array in multiple templates, but that won't work
anymore.

It seems that using the raw version of the parameter holder is secure in the
cases used in this commit, e.g. for links generation the HTML entities are
still escaped somewhere else.
Use raw validation messages when needed

In certain pages we use the validation framework to validate the contents
without really showing them, so no need to escape them. In addition, the
validation messages where customized with HTML links to metadata standard
documentation, these HTML entities can't be escaped or they'll break.