Escapes HTML entities within commands target, value and macro arguments.

Doesn't seem to be necessary to escape command names, as they're known and plain text. However, leaving
unescaped HTML in built commands may affect other tools that process those files.