AutoEscape: remove __safe function

It's not really needed now that we are only escaping <?= tags
AutoEscape: remove ini-setting function

It was almost exactly the same as ini_set(), so what's the point?
AutoEscape: improve comments in php.ini
php_escape_html_entities make 'old' param const

None of these functions modify the old string so lets make it const.
Particularlay because we need to pass it a 'const char *' from the
escape_write function
AutoEscape: remove one function call.

No sense in calling a function that just calls another function,
let's inline-it.
AutoEscape: add __auto_escape_flags ini setting

To allow modification of the flags param used with htmlspecialchars.