Improve escaping of strings in webapp.

Util.java: Improve formQuoteEscape() to also escape '&' characters, and
clarify that it's for use in HTML attribute values.

UtilTest.java: Add test for the new behaviour of formQuoteEscape().

menu.jspf: Use correct form of escaping for file type selection.

search.jspf: Escape previously unescaped strings.