Fix problem with links not being clickable for the agent

Because of the code that has been added to convert certain characters
to their HTML entities (/ and &) that also changed links (which start with http://, https://, ftp://)
which meant the code that converts links to <a>'s didn't find any links.

Solve this by converting / and & in links to ___SLASH___ and ___AMPERSAND___.
Then the special characters are converted to HTML entities.
Then ___SLASH___ and ___AMPERSAND___ are converted back to their characters.
And after that links are converted to <a>'s.
Add more protection against XSS

Everything* that comes from user input and is displayed to the agent
now goes through the _formatBody() function.

*Except Workflow.ChatSession.externalData
Fix problem with HTML entities not displaying correctly

Some unsafe characters are converted to HTML entities.
The last character to be converted to a HTML entity was &.
That meant that all other HTML entities such as &gt; had their & converted to &amp;
which meant they didn't display the HTML entity they should have.

Solve this by converting & to an HTML entity last.