Replace window.badgeData bootstrapped array w/ data attributes.

This does two things:

* Gets rid of an [XSS vulnerability](https://bugzilla.mozilla.org/show_bug.cgi?id=850755) in the backpack by forcing the serialized badge data to be escaped.
* Removes the need for an inline script tag, which brings us one step closer to supporting Content Security Policy as per the [practices documented by Github](https://github.com/blog/1477-content-security-policy).

The only thing that dissatisfies me about this PR right now is the fact that it doesn't have any regression tests. Not entirely sure how to bust those up, but I'll think of something.

Also, these changes should work fine for IE8, as it supports native `JSON.parse()`. Actually a much nicer browser than I've given it credit for.