Add an escape option to Model#toJSON

This patch adds an escape option to `Model#toJSON`.

Example:

```javascript
var model = new Backbone.Model({amp: '&', gt: '<'});
model.toJSON();  //=> {amp: '&', gt: '<'}
model.toJSON({escape: true});  //=> {amp: '&amp;', gt: '&gt;'}
model.toJSON({escape: 'amp'});  //=> {amp: '&amp;', gt: '<'}
model.toJSON({escape: ['gt']});  //=> {amp: '&', gt: '&gt;'}
```

### Why I need this?

I often use`Model#toJSON` with `_.template`. Then I have to use `<%- %>` instead of `<%= %>` to escape attributes because of XSS security vulnerability, but I think there are two problems.

1. `<%- %>` and `<%= %>` are too similar.
2. It is hard to write tests of DOM string since designers change them frequently.