Ensuring that Scripts are not injected into the page

Whilst running a security audit noticed that when a script is passed to toastr in the message or title params, it executes it instead of displaying it. To combat this issue I have:
- Added helper method to Escape HTML Characters in the notify function
- Added unit tests to validate that scripts cannot be injected via the message or title parameters