vm has a string buffer, str::htmlencode.

str::htmlencode was written for the apache module as a way to make data safe
to insert into a page. This escapes <, >, and & into their html-safe versions.

I've also added a small growable buffer to the vm. This buffer is used by
str::htmlencode since the function has no easy way of determining what size of
a buffer it should hold: In the best case, it will replace nothing and need
the same size as the string given. In the worst case, all elements will be &
and require 5 * input string size.

I will likely put a cap on the vm's buffer size at some point (to prevent
trying to exploit it with a string of a silly size).