Rewrite of BBCode parser

- fixed XSS vulnerabilty caused by unescaped quoted texts
- fixed XSS vulnerability caused by unescaped quote characters
- fixed XSS vulnerabilities caused by insecure contexts (style, href and src attribute)
- prevent invalid HTML markup (only allow <li> elements in lists, prevent stray tags, don't allow plain "&" characters, always set all required attributes)
- set nofollow attribute for links
- replaced duplicate code