Escape ampersand characters to the corresponding HTML entity

There were some unescaped ampersand characters when it comes to URL parameters.

Fix applied to

* various module classes
* Controller library

---
To reproduce the issue:

* Open the [search page](http://demo2.contao.org/en/search.html) from the Contao online demo
* Enter e.g. the keywords "james wilson" and search for it
* Check the source code view and/or validate the page with a HTML validator