Fix mixed content

Mixed content was causing https errors.  Needed to make sure image
previews were included as protocol relative.
Sanitize translation-specific CSS
Add JQueryResponse.set_text for when set_html isn't correct
websafe() the output of _() if it's to go go through unsafe()
Make sure taglinetext and updated_author are escaped
text_with_links is a sink as well
Safely translate button labels
Double-encode translated inline HTML template

This needs to be double-encoded since when the attribute is read
any HTML entities will be decoded.
Escape translated strings placed in JS by Mako
Ensafenate HTML coming out of strings.*
Make sure uses of Score.* are escaped properly
Timestamps aren't HTML and don't need unsafe()
Don't allow arbitrary HTML in translated error messages

Switch to markdown instead, you can see which translated messages
this might affect by running

    grep -RP -B1 '^msgstr.*[<>&]' . | grep -A1 -vP "^.*?[:-](-|msgstr|msgid.*[<&>])"

in the i18n directory.