Sanitize "id" attributes for HTML 4.0.1

- change `@Html.Id()` to sanitize return value; was identical to `@Html.Name()`

Copied `TagBuilder.CreateSanitizedId()` and `TagBuilder.Html401IdUtil` from MVC 5.2
- except this `CreateSanitizedId()` returns a valid identifier if first `char` is not a letter
 - e.g. "[0].Name"

nits:
- expand variable names, use lots of `var`, put `public` members first
- add doc comments for `CreateSanitizedId()`

Note users will be able to apply different sanitization once we fix #1188.

/cc @pranavkm
Does the note imply that `.` has a special role in the spec and we're handling it different? or rather that `.` is common in our generated names and isn't valid under the spec?