Issue #2559971 by stefan.r, alexpott, lauriii, nlisgo, plach, dawehner: Make SafeMarkup::format() return a safe string object to remove reliance on a static, unpredictable safe list