Add test for with_raw_haml_concat
Add and fix tests for haml_concat inside haml_tag

Contents written with haml_concat inside a block passed to haml_tag
should still be escaped if XSS protection is active.

Change existing test and add a new one that makes this cleaer.
Fix for haml_tag and haml_concat and XSS

Before this commit, haml_tag relied on haml_concat to write its output.
This created a problem when XSS protection was in use - the tags
themselves needed not to be escaped, but the tags contents should be
escaped. The current workaround used the with_raw_haml_concat method to
set a flag to control whether haml_concat should be escaped, but this is
too crude and results in any use of haml_concat inside a block passed to
haml_tag not being escaped when it should.

Create new private methods in Helpers to allow more control of writing
to the buffer, and change haml_tag to use them so that haml_tag and
haml_concat behave correctly when XSS protection is in use.

Also alter haml_concat_with_haml_xss so it still respects
with_raw_haml_concat.

See #718, #731, #732
Merge branch 'haml_tag-haml_concat-xss'