Fix issue #3: XSS filter on request parameters.

* Restrict JSoup to replace only the XHTML entities but not other
  characters like "é" or "à".
* Decode the HTML entities again afterwards.

This should be safe (provided GitBlit properly encodes such file
nameswhen it generates HTML) since by then, HTML tags should already
have been removed by JSoup. JSoup uses UTF-8 by default as encoding
for both input and output.