Add XSS information for Goodie instant answers.

- Add question to the Goodie FAQ section.
- Add questions to the developer checklist.
- Include links to OWASP as an authoritative source on XSS.
- Improve indentation in checklist for "sub-questions."
- Slightly change text of extant Goodie FAQ.

This includes the two most obvious places to attempt to get developer
attention on potential XSS issues.  The tutorial itself does not include
an example of returning HTML, so I did not want to muddy up those
waters.