Helpers use safe_concat rather than marking strings as html_safe

The #concat and #cache helpers in Rails 2.3.6 call output_buffer#safe_concat rather than calling output_buffer#concat and passing in an html_safe string. This is a major compatibility issue for alternate templating engines: Haml, for instance, uses a plain String as output_buffer, and handles XSS-escaping elsewhere. Rails should never assume that output_buffer is a SafeBuffer.

This patch on my Rails fork fixes the issue.