Escape menu URLs, targets, and IDs when generating HTML

Using proper escaping is simply a precaution in this case.  None of the
unescaped interpolation is actually reachable for malicious purposes.

Notably, menu item ->path values are appropriately sanitized thanks to
being passed through URI.pm in RT::Interface::Web::Menu.  Targets and
IDs are not used with user-input.

The escaping is bulletproofing, and there's no reason not to.
Merge branch '4.0/escape-more-menu-attributes' into 4.0-trunk