Add HTML Escaping

In theory HTML should be stripped by the use of sanitize_text_field. In practice, some escaping still needs to be done (ie: for attributes, and when rendering so that characters like quotation marks and ampersands are encoded appropriately).

(I deliberately did not modify the output of the_subtitle, only cases where HTML was being outputted directly)