Alert on html_safe

This is still pretty noisy and currently finds more than 200 html_safe usage in the code base with all (I hope? 🤞) of them possibly being safe.

I think adding all of this to the vulnerability report would be noisy so I'd need to change the CI config on the other side as well. TODO! (EDIT: gitlab-org/gitlab!125754 (merged))

Related to #16