FIX Opt-out of form message escaping (fixes #2796)

This fixes a limitation introduced through
http://www.silverstripe.org/ss-2013-008-xss-in-numericfield-validation/. Form
messages used to accept HTML, now they’re escaped by default, effectively
removing the ability to pass in HTML and take care of escaping manually.

We pass through HTML to message in core through the CTF system, so this needs
to be fixed. It’s an alternative fix to
https://github.com/silverstripe/silverstripe-framework/pull/2803.

If the fix is deemed a good one, I'm planning to merge this forward to post-2.4, 3.0, 3.1 and master - since its an artificial limitation for all of those branches.