Escape format, negative_format and units options of number helpers

Previously the values of these options were trusted leading to
potential XSS vulnerabilities.

Fixes: CVE-2014-0081

Conflicts:
	actionpack/test/template/number_helper_test.rb