Escape translations and interpolated values

We should always assume that translations and the interpolated values
that are placed into that translation are malicious. This PR will escape
any html within these by default. You may unescape interpolated values
using the `unescape` option.
Not really necessary right now. I think it'd be useful to pull out the translation part of this library and have the option to use it in the browser so I moved off of `forEach`. But, I can do that later as part of the migration to not muddle up this PR.