Use html escaper function from html/template

Instead of using a copy/pasted old html escaper, use the latest HTML escaper from `html/template`. This makes output more dependant on your version of the Go core libraries, but also increases security.