Let users download a CSV of inbound messages

In user research, we’ve seen users copy/pasting the contents of the
inbound SMS page into a spreadsheet, in order to keep a record of the
messages they receive. They even went as far as to write a macro which
fixed the errors caused by copying and pasting.

It would be much easier if we just gave them the data already in a
spreadsheet format. Which is what this commit does.

One caveat is that, because spreadsheets can contain executable code (ie
formulas), and because we’re populating the spreadsheet with
user-submitted data (albeit via SMS) we need to be careful about
injection attacks.

The details of how these attacks work are detailed here (interesting
reading): http://georgemauer.net/2017/10/07/csv-injection.html

The mitigation is to not allow characters which initialise a formula
at the start of the cell.

app/templates/views/dashboard/_inbox_messages.html

@@ -2,6 +2,11 @@
 {% from "components/message-count-label.html" import message_count_label %}
 
 <div class="ajax-block-container">
+  {% if messages %}
+    <p class="bottom-gutter-2-3 top-gutter-2-3">
+      <a href="{{ url_for('.inbox_download', service_id=current_service.id) }}" download="download" class="heading-small">Download these messages</a>
+    </p>
+  {% endif %}
   {% call(item, row_number) list_table(
     messages,
     caption="Inbox",