HTML escaping should not try to be reentrant

The `escape` filter currently tries to be reentrant by
not converting entities like `&amp;` if they are
already converted.

This prevents the use of literal entities in plain
text strings, and is just not the expected semantics
of a "plain-text to HTML" escaping mechanism.

This PR fixes the escape filter and update the tests.