In the safe_html transform escape attribute values if plone > 2.4

This prevents something like &amp;reg_ in an href from being changed to &reg_ which is interpreted as &reg; by the browser.