Merge branch 'security-fix-html-css-injection-14-10' into '14-10-stable-ee'

See merge request gitlab-org/security/gitlab!2379

Changelog: security