[SECURITY] Encode URL for use in JavaScript

The url for the Open in New Window button must be quoted for
use in JavaScript to prevent XSS issues.

Change-Id: I3e55f31c3c857989d71a5ef1a0368b96aa5e2c31
Fixes: #48693
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 4d9cd3e6f589c77b5a366497a33f7eb2099dc749
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30302
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in Backend Layout Wizard

Change-Id: I096d26b3eee20493b146633bda11529890be59dc
Fixes: #57576
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: b49bd72b12f709e1c3dffd4f471d138ad1dcceb5
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30303
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in template tools on root page

Change-Id: I2b5214e666d1c9edc5354dd3983401038e9aaf66
Fixes: #54109
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: e17bc3297e95f6ffd5d1df682235bfaac7a5ad53
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30304
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader