htmlutils: improve js string escaping

* Moves/renames jsonutils.wash_for_js() function to
  htmlutils.escape_javascript_string() as this function would mostly
  be used to escape javascript in HTML context.
  Updates bfe_bookmark accordingly.

* No longer adds double-quotes around the returned string in
  order to be more flexible regarding the context in which the
  string is inserted.

* More complete escaping of Javascript chars when 'json' is not
  installed.

* Adds parameters to control the level of escaping, to be adjusted
  according to the context (HTML vs JS output, XHTML vs HTML,
  content-type, use of CDATA delimiters).

* Adds docstrings and unit tests.

* Merge note: fixed indentation in `htmlutils.py`.

* Merge note: cherry-picked from
  86f6acbca4fe48a4af19940a6e6ab4344f5d0682.

Tested-by: Tibor Simko <tibor.simko@cern.ch>