[FIX JENKINS-22028] Allow MarkupFormatter without enabling security

Given the current default of 'Escaped HTML', it makes no sense
to require users to 'Enable Security' to set up a less secure
alternative. So show it on the global security configuration page
on top level.