Escape strings passed to share widget properly

Calling `htmlspecialchars()` on this text more-or-less does the job of
preventing XSS attacks, but it makes the titles and descriptions that
are passed to the share widget have ugly entities like `&#8217;` instead
of single quotes.

`esc_js()` handles replacing invalid UTF8 or dangerous entities, as well as
adding slashes before single quotes. Also, `esc_url()` ensures that only
valid URLs are shared.