Adjust handling of user content in i18n parameters

There are two distinct problems with user content in i18n:
* xss like `<script>alert(42)</script>`
* parameter expansion like `This is $1 topic title`

XSS is normally handled by the i18n system, but it looks like the only way
to bypass expansion of $1 into the first parameter is to pre-escape. As such
this patch switches all user content to be explitly escaped and then wrapped
in Message::rawParam to prevent parameter expansion.

Change-Id: I7cdc6bea5cc67f81df9d69a6d634b970ac6c421b
Eat all artificial whitespace in <textarea>

Change-Id: If3a92bb4e2d394deaa7e6982a8ce76cf9fdd2741
Merge "Adjust handling of user content in i18n parameters" into frontend-rewrite