Properly escape HTML.

Not escaping HTML could result in an XSS vulnerability.

* marmalade-service.el (safe-s-format): New function.
  (marmalade/package-blurb): User `safe-s-format', `xml-escape-string'
  in error case, and minor HTML fixes/changes.
* marmalade-tests.el (safe-s-format): New test.

Note: I couldn't fully test the resulting HTML because I don't have a locale elmarmalade test setup.  This is more an "inspiration" to fix the issue.