Start moving string functions into a utility class

This patch starts to move out some of our common string functions into a utility class.

My main motivation for this change is make our classes more unit testable. Currently, if a class calls format_string or check_plain, which is very common, it cannot be unit tested with PHPUnit because bootstrap.inc is not included and functions cannot be autoloaded.

I started with check_plain, format_string, and drupal_placeholder, because usage of check_plain and format_string are common in tests and many conversions to PHPUnit are blocked by them.

I moved the tests relating to these functions from XssUnitTest into a dedicted PHPUnit test, and I also added test coverage for String::placeholder (didn't see any before).