CVE-2013-6416: actionpack Cross-site Scripting vulnerability

The vulnerability stems from how simple_format handled the html_options parameter when generating HTML tags. The pre-patch code passed options[:sanitize] as the escape flag for content, conflating content sanitization with attribute escaping. This allowed unescaped, user-controlled attributes (e.g., event handlers) to be rendered directly into the HTML output. The fix removed this flawed logic and ensured attributes are properly escaped by default via Rails' content_tag handling, as shown in the commit diff modifying the content_tag invocation.