Requests for comment/Template engine

Background
Several extensions that I've reviewed have built their own template engines for reusable UI components (Wikibase, Flow, GWTools). These are usually difficult to review for security, and will likely not be updated if new exploit vectors are discovered. A few projects have started including their own templating library as well (Scholarships and Fundraising are both using Twig).

Proposal

 * Come to consensus on a reasonable template engine, along with fairly strict guidelines about how it should be used
 * Include the engine as a library in core

When I've discussed this with other developers, Twig has come up repeatedly, so I'm adding a specific proposal for that, although I don't have a particular preference for any engine in particular.

Twig
Twig - "The flexible, fast, and secure template engine for PHP"

The code can be added in includes/libs.

Usage:
 * OutputPage would have a method where the developer could pass a template and a set of substitutions, and the rendered html would be added to the output.
 * By policy, we would only allow passing scalar or simple value objects to the template. The template substitutions should never be function calls.
 * The only exception to this might be passing Message objects, so the template can decide the best escaping strategy for the message where it outputs
 * Twig would be setup to autoescape all output using its 'html' escaping
 * Twig would not be used for high-volume pages, unless the caching/performance can be addressed
 * lots more...