Manual free-text sanitisation

https://www.pivotaltracker.com/n/projects/887836/stories/74137504

This PR add validation that free-text fields in manuals don't contain dangerous HTML tags.
It isn't just tags which can be dangerous - attributes can be dangerous too. We should tweak this method to reflect that.