HTML in Sparkle appcast.xml should not be escaped

[mbacchi]

We've noticed that the Sparkle release notes are not rendered properly if HTML is provided in the omaha-server Release Notes field (issue here.)

Example of an appcast.xml:

<description>
<![CDATA[
Brave Browser version: 81.1.9.80 &lt;a href=&quot;https://github.com/brave/brave-browser/blob/master/CHANGELOG.md&quot;&gt;Brave Changelog&lt;/a&gt;
]]>
</description>

If HTML or a URL is provided in the release notes field, it should be passed into Sparkle without escape characters.

One such solution recommended by @mherrmann might be to use the Django safe template filter in the Sparkle appcast template here.