Sanitize CKEditor content before displaying it

It's possible to create a newsletter or a proposed action with
<script> tags by filling in the body using a textarea instead of a
CKEditor. While we trust our administrators not to do so, it's better to
completely eliminate that possibility.

spec/features/xss_spec.rb

@@ -30,4 +30,15 @@ describe "Cross-Site Scripting protection", :js do
 
     expect(page.text).not_to be_empty
   end
+
+  scenario "proposal actions in dashboard" do
+    proposal = create(:proposal)
+
+    create(:dashboard_action, description: attack_code)
+
+    login_as(proposal.author)
+    visit recommended_actions_proposal_dashboard_path(proposal)
+
+    expect(page.text).not_to be_empty
+  end
 end