Encode all the strings

This PR changes the default behavior of `edxmako` templates.

Here’s a list of cool things this patch does or allows:
* Introduces safe-by-default templates by HTML-encoding everything
* Fixes a lot of XSS vulnerabilities.
* Translation strings won’t have to include `&amp;` and other HTML entities in the future.
* Probably more…

This is still a WIP, so do not merge for now, I’m sending it now so everybody can be aware of this.

cc @nedbat

It was good of you to leave the nbsp as a non-breaking space, but let's just change it to a plain-old space to keep things simple. If we want orphan control, we should use a filter that can apply it to the translated string.  Also: this page is never used?? :(