Security fixes: avoid injecting javascript (XXS) using safe_html transforms.

In some views it's possible to inject javascript, which hold some risk for XXS attacks.

* Dossier overview: task link generation
* Task overview:
* Task `get_link` method
* Task actionmenu
* Actor linking
* Mail `Previewtab` (this change use [this fix](https://github.com/4teamwork/ftw.mail/pull/25) in `ftw.mail`)

@lukasgraf please have a look ...