Move html_safe declaration for user_mailer from layout to helper

This allows us to enable output safety checks for all code within
erb files.

`rubocop --auto-gen-config` ignores code within the erb files, so
it is easier to maintain an exclusion on the helper than inside
the layout.