Escape dollars in replacement strings in email templates

Fixes #499, as suggested by Matthew Somerville

I've added a simple test for the utility function; ideally, however, there
should be a test that generating the email text (i.e. the caller of this
code) works correctly.  To do that I'd refactor send_template_email to
separate the generation of the email text from the sending, so that those
can be tested separately.  However, this is just a quick fix on a busy day
when I'm meant to be working on other things...
Merge branch '499-fix-confirmation-code-emails'