Fix a XSS vulnerability with bad input to json_dumps.

Django's JSON serialization does not handle escaping of any characters
to make them safe for injecting into HTML. This allows an attacker who
can provide part of a JSON-serializable object to craft a string that
can break out of a <script> tag and create its own, injecting a custom
script.

To fix this, we escape '<', '>', and '&' characters in the resulting
string, preventing a </script> from executing.
Fix a XSS vulnerability in the gravatar template tag.

The generated gravatar HTML wasn't handling escaping of the display name
of the user, allowing an attacker to choose a name that would close out
the <img> tag and inject a <script> tag.

Django 1.4 does not include format_html(), so instead, we just call
escape() on every value going into the HTML.
Fix running the webapi unit tests on Python 2.5.
Release Djblets 0.7.30.