QA: Assert usage of esc_* functions in templates

[ScreamingDev]

Templates often just print out what's inside a variable.
This is the point where injection of bad code can be done.
WordPress has build esc_* for that which we should use in templates.

• How to assert this? So that further commits don't bring in this problem anymore.
  • It is allowed inside algorithms except templates ("HTML").
  • Maybe we need a template system or a specific folder where all templates live in.
• Find all __()/_*() and replace by esc_html or esc_attr.
• Find all echo/print and replace by esc_html or esc_attr.