ENH: add escape parameter to to_html()

Treating DataFrame content as plain text, rather than HTML markup, by escaping
everything (#2617) seems like the right default for `to_html()`, however, if a DataFrame contains HTML ([example](http://stackoverflow.com/questions/14627380/pandas-html-output-with-conditional-formatting)) or text already HTML escaped, it results in either unwanted escaping or double-escaping.

Changes in this PR:

- make HTML escaping programmable through a new `to_html()` parameter named
  `escape` (default True), allowing users to restore old `to_html()` behavior (<=0.10.0) by setting `escape=False`.

- add `&` to the list of HTML chars escaped, so strings that happen to contain
  HTML escape sequences or reserved entities, such as `"&lt;"`, are displayed
  properly.