[SECURITY CVE-2014-0014] Ensure {{group}} helper escapes properly.

This vulnerability has been assigned the CVE identifier CVE-2014-0014.

In general, Ember.js escapes or strips any user-supplied content before
inserting it in strings that will be sent to innerHTML.  However, we
have identified a vulnerability that could lead to unescaped content being
inserted into the innerHTML string without being sanitized.

When using the `{{group}}` helper, user supplied content in the template
was not being sanitized. Though the vulnerability exists in Ember.js proper,
it is only exposed via the use of an experimental plugin.

In applications that use the `{{group}}` helper, a specially-crafted
payload could execute arbitrary JavaScript in the context of the current
domain ("XSS").

This vulnerability was reported to us by Edward Faulkner of CleriCare.
Many thanks for working with us on the patches and advisory.
[SECURITY CVE-2014-0013] Ensure primitive value contexts are escaped.

This vulnerability has been assigned the CVE identifier CVE-2014-0013.

In general, Ember.js escapes or strips any user-supplied content before
inserting it in strings that will be sent to innerHTML.  However, we have
identified a vulnerability that could lead to unescaped content being inserted
into the innerHTML string without being sanitized.

When a primitive value is used as the Handlebars context, that value is not
properly escaped.  An example of this would be using the `{{each}}` helper to
iterate over an array of user-supplied strings and using `{{this}}` inside the
block to display each string.

In applications that contain templates whose context is a primitive value and
use the `{{this}}` keyword to display that value, a specially-crafted payload
could execute arbitrary JavaScript in the context of the current domain
("XSS").

This vulnerability was discovered by Robert Jackson of DockYard. Many
thanks for working with us on the patches and advisory.
Refactor sanitization into reusable function.
Update CHANGELOG.
Add missing entries to CHANGELOG.
Remove unused variable
Merge pull request #4153 from mjijackson/remove-unused-var

Remove unused variable
Add Ember.setupForTesting.

This makes it somewhat easier to unit-test Ember. It also gives us a
good place to add additional customization (as opposed to advocating
simply setting `Ember.testing = true`).
Add missing links to FEATURES.md.
Add composable-computed-properties to FEATURES.md.
Add link to string-parameterize feature.
improve performance of Ember.guidFor and Ember.generateGuide on
Ember.Objects

Ember's guidKey uses defineProperty so that it is not enumerable,
this is a great idea, but can cost be a hard hit. Luckily though,
we pre-shape all ember objects to have a GUID_KEY slot. Unfortunately,
in guidFor and generateGuid we redefine the property. Not only is this
wasteful, but Object.defineProperty is incredibly costly.
Merge pull request #4158 from stefanpenner/improve-performance-of-guid-for

improve performance of Ember.guidFor and Ember.generateGuide on
Update ember-dev, use the new async expectDeprecation helper
Merge pull request #4166 from mixonic/async-deprecate

Use the new async expectDeprecation helper
avoid exception due to console miss on IE 8
Enable features given a 'go' status.

New features as of 2014/01/17:

* `ember-testing-routing-helpers`
* `ember-testing-triggerEvent-helper`
* `computed-read-only`
* `ember-metal-is-blank`
* `ember-eager-url-update`

Also, removed `composable-computed-properties` as it was accidentally
commited in another unrelated PR.
[FEATURE ember-testing-triggerEvent-helper] Allow event options to be specified.

Allow specifying options to the event created by the `triggerEvent`
helper. This allows us to utilize `triggerEvent` from `keyEvent`.
Merge pull request #4177 from rjackson/allow_event_options_to_triggerEvent

[FEATURE ember-testing-triggerEvent-helper] Allow event options to be specified.
Merge pull request #4063 from mmpestorich/search-proxy-paths

Allow Ember.computed.sort to use property paths in sortDefinitions.