Add XSS information for Goodie instant answers.

- Add question to the Goodie FAQ section.
- Add questions to the developer checklist.
- Include links to OWASP as an authoritative source on XSS.
- Improve indentation in checklist for "sub-questions."
- Slightly change text of extant Goodie FAQ.

This includes the two most obvious places to attempt to get developer
attention on potential XSS issues.  The tutorial itself does not include
an example of returning HTML, so I did not want to muddy up those
waters.
XSS information updates.

- Equivocate less in the FAQ answer.
- Make doubly sure that they understand which sorts of strings may be
  dangerous in the developer_checklist.

As always, big thanks to @moollaza for proof-reading and
editorial assistance.
FAQ: fix ugly typo.

I really need to make fix my markdown handling and color scheme so I can
read this more easily in the editor.. instead of pushing out nonsense
like this and catching it on the page.
Merge pull request #39 from mwmiller/xss_info

Add XSS information for Goodie instant answers.