error_string() allow HTML tags in lang string

Prior to this, HTML escaping was applied after parameter substitution,
on the whole string.

Now, the language string for the error message is considered trusted
input and is therefore not escaped; we only process the parameters,
allowing
tags, before they are inserted into the placeholders.

Fixes 0025749