XSS linting, fixes CNVS-17663

no significant issues/vulnerabilities fixed in this commit, rather this is
a catch-all so we can enforce linting in the build.

to better understand what's going on here, see the following:

* public/javascripts/.xssignore
* script/xsslint.js
* https://github.com/jenseng/xsslint

high level summary of what's going on in this commit:

1. .html/.append/etc. now know what to do with a SafeString ... in many
   cases we now put a $.raw around an .html argument to tell the linter
   it's ok
2. although translation is an unlikely attack vector, we now htmlEscape
   I18n.t calls used in html snippets, etc. this is a good thing, as it
   ensures we don't create a vulnerability later (e.g. by interpolating
   user content into a translation)
3. many vars were renamed (Html suffix, $ prefix) to let the linter know
   it's something that was manually vetted
4. in some cases, rather than renaming or creating a superfluous var,
   we add special xsslint comment overrides

test plan:
specs should all pass

Change-Id: Ide1df825b798d1b0c468a5308802543bf716c0d7
Reviewed-on: https://gerrit.instructure.com/46097
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Derek Hansen <dhansen@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>