Always escape error messages

Before, if your error message contained HTML tags, they were marked as
safe. Some error messages may contain user input so this would
lead a XSS vulnerability.

Error messages are now always escaped. If users need to mark them
as safe they will need to use the explicit `:error` option:

    f.input :name, error: raw('My <b>error</b>')
Release 2.1.2
Merge branch 'sec-fix-2.1' into v2.1

Conflicts:
	CHANGELOG.md
	Gemfile.lock