EscapeUtils.html_escape performance

This removes all allocations and copies in the special case where the target string requires no escaping. The original ruby string is returned to the caller.

/cc @vmg @github/systems