hgweb: urlescape all urls, HTML escape repo/tag/branch/... names
Without this, repository paths or names containing e.g. & characters or html
tags yielded strange results, possibly allowing cross-site scripting attacks.
<item>
<title>{desc|strip|firstline|strip|escape}</title>
<guid isPermaLink="true">{urlbase}{url|urlescape}rev/{node|short}</guid>
<description><![CDATA[{desc|strip|escape|addbreaks|nonempty}]]></description>
<author>{author|obfuscate}</author>
<pubDate>{date|rfc822date}</pubDate>
</item>