Notifications: think more about how to render them safely

[humitos]

@stsewd mentioned a few times that we need to escape all the values we render in the notifications that comes from the user. Due to that, we implement this small trick to run escape() on each of them: #10996

However, we are always passing the instance the notification is attached to (User, Project, Organization, Build, etc) to the Message class to have access to all of fields from it. Due to that, there are some fields like project.name where the user has control and we have to escape() somehow.

I see two possible paths here:

1. change the rendering engine from regular Python .format()s + trick to call escape() on all the fields and use something like Jinja or regular Django Template Engine where we can call {{ project.name|escape }}
2. write an improve for the current rendering engine that it's always safe. Maybe using .format_map with a custom dict class that call escape() on __getitem__ (https://docs.python.org/3/library/stdtypes.html#str.format_map)

• Related: New notification system: implementation #10922 (comment)
• Related: Notifications: use instance.slug instead of instance.name #11018

[stsewd]

I think using Django's template engine should be fine, since it escapes all values by default.