Revert "Escape '&' in anchor hrefs" - missed escaping '"'

This reverts commit c90f92600716ef7bf3c9efa9344d475586aa32a4.
Escape anchor hrefs ('&', '"', ' ', etc.)

'&' and '"' need to be escaped as '&amp;' and '&quot;' in html attributes.

' ' needs to be escaped as '+' or %20 in query string parameters.
Escape form input values by fixing usage of set_value()

Double quotes and so on need to be escaped inside attribute values.
In most cases set_value() does this for us, but that doesn't work
when we bypass it :).

It looks like this also fixes a bug in these forms.
Now, if you enter an invalid value and hit submit,
you'll get _your_ value back, so you can edit it
and try again.  Previously, the value would have
been reset to the original from the database,
which could be a bit frustrating.
Escape variables that need it

I.e. variables loaded from the database.
(Also module details in the modulebuilder index).

We can't rely on xss_clean() to prevent XSS attacks.
It's broken at the moment, and has been broken twice before.

https://github.com/EllisLab/CodeIgniter/issues/1705#issuecomment-7723346=
http://blog.kotowicz.net/2012/07/codeigniter-210-xssclean-cross-site.html
http://blog.astrumfutura.com/2011/05/codeigniter-2-0-2-cross-site-scripting-xss-fixes-and-recommendations/

If you don't want users to be able to insert rich markup
(Bonfire doesn't, at least outside the emailer class)
xss_clean is trying to do way more than you need anyway.
So if we work towards rooting it out, we could be more
confident in our security _and_ performance.
gravatar_link(): escape alt and title

These are set to the user's email, or display name.

When testing the escaping in user_form.php,
gravatar_link() also let unescaped HTML through.
Luckily this happened to result in invalid html,
which showed up in the html validator.
Consistent escaping of site.title

site.title was escaped e.g. in mobile__header.php
(and is used in at least one attribute value).

Obviously no attack vector.  The point is the config item should either
allow markup, or not.  If it doesn't allow markup, it should handle
characters like '&', '"', and '<' correctly in all cases.
(OR document it as a problem).  And it is used inside <title>,
so we don't really want to allow custom markup.
Merge branch 'develop' into valid-4-escape-source-audit-v2

Resolve conflicts, so this can still be merged automatically by github.

Conflicts:
	bonfire/themes/default/parts/head.php
gravatar_link(): blind users don't need to know that Bonfire uses gravatars

The empty string is a valid value for the alt attribute.
It is similar to aria-role="presentation".

In the admin topbar, blind users should be able to read the users display
name (assuming we haven't screwed up somwhere).

If gravatar_link() is used in content, e.g. in a forum or blog, the calling
code should do the same thing: show the display name as well, which will be
very useful to everyone.
Merge branch 'gravatar-use-empty-alt' into valid-4-escape-source-audit-v2

Resolve conflicts, so this could be merged automatically by github
(there'll almost certainly be more conflicts before is gets merged though)

Conflicts:
	bonfire/application/helpers/application_helper.php
Merge branch 'develop' into valid-4-escape-source-audit-v2

Conflicts:
	bonfire/application/core_modules/activities/views/reports/index.php
	bonfire/application/core_modules/ui/views/settings/index.php
Merge remote-tracking branch 'sourcejedi/valid-4-escape-source-audit-v2' into escape_more
Changing to the use of settings_item instead of config_item for items in the settings DB