Theme functions deprecated, helper function for autoescaping added for theme functions

Theme functions should be avoided as a use to construct HTML, because its hard to ensure safeness, use Twig templates instead.
Nevertheless #2572929: Document lack of auto-escape in theme functions and add a theme autoescape helper function added a helper function theme_render_and_autoescape which works similar to twig autoescaping, so theme functions don't have to care what is inside variables, so that the result is always properly escaped (not double escaped) but also rendered first from the render array to a string.

This function also ensures that render arrays are rendered

Before

function theme_language_content_settings_table($variables) {
  return '<h4>' . $variables['build']['#title'] . '</h4>' . drupal_render($variables['build']);
}

After

function theme_language_content_settings_table($variables) {
  return '<h4>' . theme_render_and_autoescape ($variables['build']['#title']) . '</h4>' . theme_render_and_autoescape($variables['build']);
}

Related change records

See Twig autoescape enabled and text sanitization APIs updated for a full list of related change records.