escape_once works on frozen strings.

That way, it works the same way as #html_escape and
ERB::Util.html_escape_once for which it acts as a replacement in Rails.

Furthermore, it is not obvious from the method name that the string
given as an argument is being changed.
Merge pull request #721 from patrik/stable

escape_once does not work on frozen strings