Issue #21: consistent clip url queries in json config and api

This allows to give unescaped ampersands and equal signs in the json
configuration or parsed anchors of clip urls.

They must be escaped because they are written as flashvars into the
generated object.

Whereas api methods, like play(url), needed unescaped urls.

This change tries to be very defensive and only addresses clip urls
to avoid the issues encountered in 3.2.8 with point blank escaping the
entire configuration. Note that the substitution also touches the query
part of an url only as & and = are only allowed there.

Use case: amazon cloudfront signed urls.

See also: http://flash.flowplayer.org/forum/8/103438/

TODO: look for other occurences where this can be done in a safe way,
like for the queryString paramter of the pseudostreaming plugin.