Do not add placeholders from SafeMarkup::format() to the safe list

Problem/Motivation

Currently, when passed an @ placeholder, SafeMarkup::format() (and therefore t()) calls SafeMarkup::escape():

      case '@':
        // Escaped only.
        $args [$key] = static::escape($value);
        break;

escape() in turn calls checkPlain() in the case where the string is not already marked safe:

  return static::isSafe($string) ? $string : static::checkPlain($string);

And checkPlain() then adds the sanitized string to the safe list:

  $string = htmlspecialchars($text, ENT_QUOTES, 'UTF-8');
  static::$safeStrings [$string]['html'] = TRUE;

There are a couple of problems with this:

1. It pollutes the safe list with many, many placeholders that will never be printed independently of the main string, and therefore do not need to be marked safe. See #2505701: Document SafeMarkup::set and Use htmlspecialchars() directly in Attribute() so we don't bloat the list of safe strings for why this matters -- that issue may result in significant memory savings on pages with a lot of Attribute use (which includes use of the LinkGenerator).
2. It actually violates the intent of the calling code. In the calling code, what is considered as safe and intended for output is the whole string, not bits of it.

Proposed resolution

In SafeMarkup::format(), use htmlspecialchars() directly instead of checkPlain(). My initial idea is to add a protected variant of escape() that uses htmlspecialchars(). The advantage of this would be that it would still respect the placeholder if it were already in the safe list as it does following #2435493: Change String::format()'s '@' and '%' placeholders to be auto-escaped rather than always-escaped, but it would not pollute the list with lots of meaningless escaped placeholders we don't care about.

The disadvantage would be that a placeholder that is used in two separate SafeMarkup::format() or t() calls would now get htmlspecialchars()ed on each separate SafeMarkup::format() if it were something not otherwise added to the safe list. However, I'm willing to bet that case is far rarer than using a placeholder's content only once in a request. (And, if we ever really need to optimize something to minimize htmlspecialchars() calls, we can always add an explicit and documented SafeMarkup::set(). But we're talking about a native PHP function.)

Beta phase evaluation

Remaining tasks

TBD

User interface changes

TBD

API changes

• Possible API additions
• Change in the behavior of t() and SafeMarkup::format() to no longer add placeholders to the safe list.