Escape HTML with optional overrides

[eelcoj]

Context options interpolated into HTML bodies were rendered verbatim, so values like <script>alert('xss')</script> could land in the email. This typically is no issue: developer authors templates and most (all?) email clients strip <script> tags (but attributes like onerror and layout-breaking tags can still slip through).

So mitigate this altogether and only explicitly allow HTML with h() and html_safe(). Context options are now auto-escaped when rendered as HTML; use h(value)/html_safe(value) per attribute or html_safe { … } per block to opt out. Subject and plain-text bodies are unaffected.

This is a breaking change: HTML emails relying on raw interpolation must now wrap values in h(value)/html_safe(value).