HTML escaping should not try to be reentrant

The `escape` filter currently tries to be reentrant by not converting entities like `&amp;` if they are already converted.

This prevents the use of literal entities in plain text strings, and is just not the expected semantics of a "plain-text to HTML" escaping mechanism.

This PR fixes the escape filter and update the tests.
Looking at this again, I very much expect that if my variable has quotes in it and escaping is turned on, the quotes will be turned into HTML entities.

I'm closing this issue because of this.