TPCUtil::sanitize(): Convert MediaWiki's bold and italic markup.
Escape percent signs by default, but not in hardcoded strings.

In the end, we wanted to have this after all. Keeping all of the original sprintf calls is the only correct and consistent solution.
TPCUtil::sanitize(): Convert &nbsp; to Unicode no-break spaces.

This facilitates a much nicer workaround for padding template parameters than using full-width spaces.