Added /away and /back commands.

xmpp now has a sendStatus() function that will
send a presence to the current roomnick with
an optional <show> and <status> element.

Also, the status on incoming presences will
be shown in the notification if present; the
user-link will also be updated to display an
away icon when appropriate.

Some bugs in other functions were exposed and
fixed due to this feature.
Italicize bot messages.
Show off-domain users as guests.

This might be useful on MUC servers that
allow users from other domains.

Since we already parenthesize nicks that don't
match their node name, we also need to do this to
nicks that are connecting from a domain other
than the standard (ie the one set in the client).
Don't format bot messages.

They don't need output filtering
(that's done at the generation point),
and we don't want notifications to
have emoticons in them.
Several output security fixes.

The greatest security consideration is script safety
of the recipient. Incoming Javascript could significantly
compromise the client, including the leakage of XMPP
session or authentication data.

We can't trust XMPP servers to keep HTML safe.
This filtering must be done by the recipient.
Therefore we pick a small whitelist (a,img,span,q,
code,strong,em,blockquote) of tags, and replace all
the others with their escaped outerHTML.

Furthermore, add a configurable limit (24/1024)
on nick and message length, which will be applied both
to incoming and outgoing messages.

Outgoing HTML will furthermore be escaped before
rendering BBCode. That is not real security, because
it happens on the client, but it will prevent
unintentional errors.