fix candidate for reflected XSS vulnerability on webform confirmation pages.

A fix in two parts: 

When a confirmation message is rendered, the entire confirmation message body is passed through filter_xss_admin() once all webform and token module tokens are replaced.

 On the submission side, hook_webform_submission_presave() is implemented to filter webform submission values for XSS vectors before the submission is saved to the database.
Do we need this filter if we're sanitizing individual submission values before db insertion?