Add escape_url_attributes option for src, href, and background attributes

@jdoconnor