Escape untrusted value to allow html tags in error messages

```
SimpleSchema.messages({
  expectedNumber: “<strong>[value]</strong> must be a number"
});
```
This small change would allow html tags within the error message itself
to rendered without also rendering any html tags that may have been
included in a value by a nefarious user.