Adopt lint block, pin stable toolchain, cargo fmt, fix clippy
Security: single-source escaping into js/escape.js, cover the compose window; bump ammonia