CGI.escape emoji name

The commonly used `+1`, when located somewhere like S3, will not work
as the + is not escaped, causing the browser to think it's a space
instead of a literal `+`. To replicate, upload +1.png to S3 and try to
bring it up in Chrome.

This commit escapes the emoji name before returning the img tag.