Security Fixes for XSS and Shell Injection

These changes address cross-site scripting (XSS) in various status messages, as well as shell injection via job execution and the release tagger.

/cc @zendesk/samson

### TODO

- [x] refactor models to call sanitize and shellescape
- [x] refactor job_execution tests

### RISKS
- verify that legal messages and strings don't break due to new sanitization code
What is being sanitized?  User name/email, though I have now removed these in favor of using the h() function instead.  Were I to use sanitize (now or later) it is better to locate them in the model, and I did try that earlier, but it required the *include* of a viewer class there which I decided at the time to avoid.  However, it is fine to include the ActionViewer class in the model, and to use sanitize in the model.