Cherry pick security fix (#274) to 2-5-stable

See discussion in https://github.com/Shopify/liquid/pull/274.

This cherry-picks Dylan's fix (4e14a65) into the 2-5-stable branch, so we can release 2.5.5 to RubyGems.

@arthurnn @dylanahsmith