HTML escaping should not try to be reentrant

The `escape` filter currently tries to be reentrant by not converting entities like `&amp;` if they are already converted.

This prevents the use of literal entities in plain text strings, and is just not the expected semantics of a "plain-text to HTML" escaping mechanism.

This PR fixes the escape filter and update the tests.
@paularmstrong This is just peripheral, due to the change of the test at the bottom:

```
-          expect(swig.render(code, { locals: { v: c.v }}))
+          expect(swig.render(code, { autoescape: false, locals: { v: c.v }}))
```

`addslashes` obviously doesn't convert quotes to HTML, it's `autoescape` that was doing that. We need to remove the autoescape or else we just cannot test anything.