FIX Opt-out pf form message escaping (fixes #2796)

This fixes a limitation introduced through
http://www.silverstripe.org/ss-2013-008-xss-in-numericfield-validation/. Form
messages used to accept HTML, now they’re escaped by default, effectively
removing the ability to pass in HTML and take care of escaping manually.

We pass through HTML to message in core through the CTF system, so this needs
to be fixed. It’s an alternative fix to
https://github.com/silverstripe/silverstripe-framework/pull/2803.