[BUGFIX] Use callback in preg_replace in RemoveXSS

Since PHP 5.5.0 the use of the /e modifier is deprecated in preg_replace.
Use callback function instead.
Also change comments to CGL format.

Change-Id: I44f12e8bfa1c976e494dae847cc6c53d15ed7c2d
Fixes: #52771
Releases: 6.0, 6.1, 6.2
Reviewed-on: https://review.typo3.org/24723
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
Reviewed-by: Markus Klein
Tested-by: Markus Klein