Don't escape HTML entities in link tags

We occasionally see 404 responses go out from Spotlight because
a client has made a request of ``GET /performance/&``.

I believe this may be because of the way Mustache is HTML-escaping
entities like this:

    <a href="&#x2F;performance&#x2F;carers-allowance">

In some clients, this might make a request matching the 404s we see,
because everything after the 2nd hash is treated as a fragment and
isn't sent to the server.

Anyway, just a theory. It's got some holes in it.

In any case, I think not HTML escaping the contents of href attributes
is the correct thing to do.

I'm going to make a similar pull request to alphagov/govuk_template
to address places this happens in the template.