[FEATURE] UnsafeHTML interface to allow passing variables to template without being escaped (#1288)

[s2b]

Fluid escapes variable output by default to prevent XSS. In some cases,
however, values originate from a trusted/sanitized source (e.g. HTML
generated from a sanitizer, CMS RTE output, a Markdown renderer with
a strict allow-list, …) and should be rendered as HTML without forcing
template authors to opt out of escaping via f:format.raw or similar.

This change introduces a marker interface
TYPO3Fluid\Fluid\Core\Parser\UnsafeHTML for values that should be
rendered unescaped. Any object implementing this interface will
bypass Fluid’s escaping and will be output as-is via __toString().
For now, this interface is marked as @internal to be able to make
adjustments within the Fluid 5 branch, if necessary.

A small helper value object UnsafeHTMLString is included for convenience.

Example (PHP):

use TYPO3Fluid\Fluid\Core\Parser\UnsafeHTMLString;

// $safeHtml must already be sanitized/escaped appropriately
$view->assign('content', new UnsafeHTMLString($safeHtml));

Template:

{content}

Technical notes:

• EscapingNode now detects UnsafeHTML and returns the value unescaped.
• The compiled escaping closure generated by the TemplateCompiler
  includes the same check, so compiled templates behave identically.
• Boolean expression evaluation unwraps UnsafeHTML to a string first,
  so empty HTML values behave like empty strings in conditions
  (e.g. {content} is false when it’s '').

Tests/examples have been adjusted accordingly.