templatetags: Do not mark output of msgid tag as safe

templatetags: Do not mark output of msgid tag as safe

The msgid template tag exists to remove angle brackets from either side of
the Message-ID header.

It also marks its output as safe, meaning it does not get autoescaped by
Django templating.

Its output is not safe. A maliciously crafted email can include HTML tags
inside the Message-ID header, and as long as the angle brackets are not at
the start and end of the header, we will quite happily render them.

Rather than using mark_safe(), use escape() to explicitly escape the
Message-ID.

Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com>
(backported from 133a6c90e9826376be0f12f2ae6c2d7b076bdba0)
Signed-off-by: Daniel Axtens <dja@axtens.net>