Security fixes: avoid injecting javascript (XSS) using safe_html transforms.

In some views it's possible to inject javascript, which hold some risk for XSS attacks.

* Dossier overview: task link generation
* Task overview:
* Task `get_link` method
* Task actionmenu
* Actor linking
* Mail `Previewtab` (this change use [this fix](https://github.com/4teamwork/ftw.mail/pull/25) in `ftw.mail`)

@lukasgraf please have a look ...


<!---
@huboard:{"order":255.5,"milestone_order":627,"custom_state":""}
-->

`XXS` -> `XSS`