Webrev updated to version 23.18

[Jean-Christophe Collet]

I've updated the webrev script to fix a potential security issue pointed 
out by Jim Laskey.
When generating a webrev from a 'hg outgoing', if .hg/hgrc contained the 
username and password in the URL (a practice best to avoid in any cases) 
it would end up in the index.html.
The script now sanitizes the URL before including it in the HTML

I've updated all the usual places, including the external one (on my blog).