Field_set_tag doesn't escape the legend

Can't apply this to 2-3-stable as it'll break people's apps who have already added h() calls, we can fix it in master though where h() is idempotent.

On 3.0 is working that way.
It's automatically escaped because you start with a SafeBuffer and the output builder concat that legend with the SafeBuffer he manages using this method from SafeBuffer

module ActiveSupport #:nodoc:
  class SafeBuffer < String
    def concat(value)
      if value.html_safe?
        super(value)
      else
        super(ERB::Util.h(value))
      end
    end
    alias << concat
  end
end

That's fixed with http://github.com/spastorino/rails/commit/84fd5400c065b6ca659a50354...

This is going to be fixed on github.com/rails/rails_xss