Escape HTML characters in user name when showing it on a web page.

This addresses a security flaw in previous versions, pointed out
by Davy Stoffel.  A fake password reset email could be provided
to users, with the link:

    http://gitit.net/_doResetPassword?reset_code=azeaze&username=davy%3Cscript%3Ealert%281%29%3C/script%3E

If the person clicked the link, the unknown username would be
displayed (unescaped), and the javascript would run.

This fix addresses the flaw, not by preventing the funny user name,
but by ensuring that the HTML tags are escaped when the user name
is shown on the page.
Version bump to 0.10.6
Updated CHANGES.
Added Network.Gitit.Compat.Except to cabal module list.
Update version to 0.10.6.1.
Update CHANGES.
update issues link

According to https://code.google.com/p/gitit/, "This google code site is no longer used. Please see the github site for the source code **and issue tracker.**" (emphasis mine)
Merge pull request #469 from waldyrious/patch-1

update issues link