Add rule to prevent XSS vulnerable strings being used in translateable strings

Problem/Motivation

This is a fairly regular issue that translatable strings contain markup that could be imported as translated strings due to locale_string_is_safe() running them through Xss:filter(). A typical example would be <br/> which gets rejected, while <br /> (with a space in front of the end tag) is perfectly OK.

Steps to reproduce

Proposed resolution

A rule that checks for known patterns or even also uses Xss:filter() to identify and reports unsupported strings as an error.

Remaining tasks

User interface changes

API changes

Data model changes