Switch from `bind-html-unsafe` to `ng-bind-html` in typeahead

[wesleycho]

For security reasons, we should only be adding whitelisted HTML - we should not be using an unsafe binding mechanism.

[wesleycho]

This requires a change in the typeahead-match.html template, as well as likely some work fixing the tests to whitelist the templates. This also requires some change in typeahead itself, including the typeaheadHighlight filter.

[wesleycho]

This should be addressed by the changes in #3463.

[wesleycho]

This is also a duplicate of #2884