_includes/social-buttons.html: escape ampersands in URLs so HTML validates

Or rather, gets closer to validating. Tested locally.