Remove illegal characters from XML strings before parsing.

It's easy for people to unintentionally inject XML-unsafe characters
into a string from a copy/paste when filling out the Description or
Testing Done fields of a review request.

We now sanitize the XML before attempting to parse it, removing any
illegal characters. The result is a string that can be safely parsed
with no noticeably defects.

Reviewed at https://reviews.reviewboard.org/r/6670/