(CE-1176) Properly sanitize link attributes and contents in GlobalNav

Properly sanitize link attributes and contents in GlobalNavigation Account
Navigation module. This caused a reflected XSS vulnerability and has two
parts to the fix:

  1. Don't construct a link manually that doesn't do any escaping and
     instead use Xml::element which will escape both the attributes
     and the contents of the link.
  2. wfGetReturntoParam does not URL encode parameters passed to it
     so the title retrieved from the current query must be first URL
     encoded.
(CE-1177) Sanitize search query in GlobalNavigation

Sanitize search query in GlobalNavigation, as previously it was unchecked
and so caused a reflected XSS vulnerability. Also sanitize other parameters
and correct i18n output formats for good measure.
(CE-1178) Sanitize attributes in Wall link of UserPagesHeader

Sanitize attributes in Wall link of UserPagesHeader. The lack of
sanitization caused a reflected XSS vulnerability. Don't construct
a link manually that doesn't do any escaping and instead use
Xml::element which will escape both the attributes and the contents of
the link.
(CE-1179) Prevent DOM-based XSS on Special:CreatePage

Special:CreatePage loaded the title of the page into the DOM with HTML
from a URL parameter. This switches from .html to .text which will escape
the title text when adding it to the DOM.
Merge pull request #5704 from Wikia/release-254-CE-1175

CE-1175 Fix various XSS vulnerabilities