Encode HTML by default

Encode HTML entities in the the message body, so that it'll display messages with special characters (`<`, `>`, `&`) correctly and avoid potential XSS vulnerabilities. This can be overridden by specifying an `html: true` option.

Also added two new tests for the new behavior.

I wasn't sure whether I should commit the new generated `toastr.min.js` file or not... I did not include it - let me know if I should.