Macros: Fix encoding of macros.

No macros should be escaped because of which macros is resolved, but for where
the macros is put.

URL-encoding macros should be done when building an URL, not if the URL is
included in the macro. Therefore, encoding options should only be brought
downwards, and only one level in the encoding.

An example:

notes: this is a string escaped with & and other chars for $HOSTADDRESS$
notes_url: http://wiki.example.org/?notes=$HOSTNOTES$&address=$HOSTADDRESS$
action_url: http://example.org/?notes_url=$HOSTNOTESURL$&notes=$HOSTNOTES$

The result should be something like:

notes:
address should be included, but not escaped. It should be readable by a person

notes_url:
both notes and address should be url-encoded, because they are a part of the
url, but shouldn't change the structure of the url (like including new
variables)

action_url:
should urlencode notes_url, which means parts is double-encoded, because the
notes_url-attribute should, when unpacked by the web server, contain the
notes_url, and the notes should be encoded, so the same applies to notes

Signed-off-by: Max Sikström <msikstrom@op5.com>
Checks: Escape command line arguments correctly

Command line arguments should be stripped of a couple characters, so it isn't
possible to break out of for example strings, and start redirecting output and
write to files, given values of macros. And extra important is for macros that
can be updated from a user.

Previously, this wasn't that big issue, when macros itself could say that they
should be escaped. But the concept of escaping also depending which macro it
entered gives lot of other problems (notable for url:s at least, see previous
commit).

Only the requestor of the macro expansion knows where it's going to be used, so
only the requestor has the information to tell what to escape, and therefore,
this patch tells the macro expansion to escape the macros to be used as a
command line for check commands...

Signed-off-by: Max Sikström <msikstrom@op5.com>