Fix escaping to support escape of XLSX formulae

[matthewhegarty]

Problem

Issue #1543. Security vulnerabilities present due to not escaping potentially malicious content.

Solution

I have introduced two new settings attributes:

• IMPORT_EXPORT_ESCAPE_HTML_ON_EXPORT
• IMPORT_EXPORT_ESCAPE_FORMULAE_ON_EXPORT

I have deprecated: IMPORT_EXPORT_ESCAPE_OUTPUT_ON_EXPORT

The reason for the change is that malicious strings can be present exported to a variety of formats and still be an issue. For example, exporting bad HTML to CSV might still be an issue if the user opens the exported csv into a browser somehow.

Likewise, dodgy excel formulae could be exported to csv, tsv, ods, xls and xlsx and opened in Excel, so this need addressing for all formats.

I decided that it might be better for users to have more control over escaping, hence why two settings are used. I can envisage that if someone only ever exports to HTML, there could be cases where they don't want any leading '=' characters replaced.

Acceptance Criteria

• Integration tests
• Manual testing
• Documentation updates

[coveralls]

Coverage: 100.0%. Remained the same when pulling c4d4c68 on matthewhegarty:1543-xlsx-vuln into fe4acc7 on django-import-export:main.

[mil1i3]

I have tested all 3 parameters to all formats and everything looks Ok.

[pokken-magic]

This is a cool, boring, totally nonsexy but deceptively important bit of code. Appreciate you doing this.