Add support for interactive app form descriptions

[robinkar]

This PR fixes #3405 by implementing a form_header option for the form YMLs. The form header will be shown only in the interactive app forms, as seen in the example screenshots in #3405.

Example usage:

# form.yml.erb
form_header: |
  [Documentation](/link/to/documentation)

  The shell / SSH session will stay open and any programs started there will stay running...
attributes:
  ...
form:
  ...

[johrstrom]

Should it be html_safe? I feel like that's a way to inject <script> tags in an odd way.

Links I think maybe OK - but it seem to me that we should sanitize it in some way to be sure at least scripts don't work.

https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html

[robinkar]

I did test <script> tags, and they seemed to be sanitized away, but I'll take another look at it.

[johrstrom]

Thanks for looking into it, I didn't try myself, I just think about it when i see html_safe.

[robinkar]

Replaced html_safe with sanitize. Using the defaults for now, which seemed to even sanitize away div elements and id tags used in the tests. I haven't looked into whether the permitted tags list needs to be customized or not.

[johrstrom]

Realistically I'm only worried about script tags.

[johrstrom]

Thanks!