Make templates HTML-safe by default

Migrated from legacy PR https://github.com/CenterForOpenScience/osf/pull/1231.
Should the `json` filter be used here rather than calling `json.dumps`?