[FIX JENKINS-22028] Allow MarkupFormatter without enabling security

Given the current default of 'Escaped HTML', it makes no sense
to require users to 'Enable Security' to set up a less secure
alternative. So show it on the global security configuration page
on top level.

---

A solution using a proper descriptor, similar to `GlobalCrumbIssuerConfiguration` to get rid of the special handling of this option, can always be added later.