Use block parameter rather than `$1` during `gsub!` so `ActiveSupport::SafeBuffer` values aren't mangled.

Fixes #15064
Require active_support/core_ext/string/output_safety and use html_safe rather than use non-public SafeBuffer API.
Merge pull request #15072 from mjtko/fix/issue-15064

[Fixes #15064] Calling number_to_delimited on a ActiveSupport::SafeBuffer results in mangled output