Security-relevant changes to HTML / template styleguide

:eyeglasses: @umbrae @ajacksified 

These guidelines should help folks avoid some common pitfalls and subtle errors with HTML templates
I think this needs to be even more highlighted, especially for new/more junior folks who might not know what gettext is. Maybe "Any untrusted strings **including translated strings from `_` aka gettext** must be escaped when used inside `unsafe()`."