Escape format, negative_format and units options of number helpers

Previously the values of these options were trusted leading to potential XSS vulnerabilities.

Fixes: CVE-2014-0081

See: https://github.com/rails/rails/commit/eaa2101b294ef546cc3fb35cc3f49c73849ac470#diff-44f4d98aef8bf0af214e5fa29065cf2bR309