Improve escaping of strings in webapp.

Util.java: Improve formQuoteEscape() to also escape '&' characters, and
clarify that it's for use in HTML attribute values.

UtilTest.java: Add test for the new behaviour of formQuoteEscape().

menu.jspf: Use correct form of escaping for file type selection.

search.jspf: Escape previously unescaped strings.
field type adjustments, ui fixes
add spaces to help text before (
remove dead/commented out code