Escape field values in datagrid cells.

Datagrid cells would pull data from a model and render it as-is. This
could lead to issues when using certain characters. We now escape
everything coming from the database.

If a custom renderer is provided, it's still expected that it returns
valid, safe HTML.
Merge branch 'release-0.6.x'