Add missing escaping

Adds a variety of escaping improvements (mostly to translations) to harden the theme against XSS, XSRF, and other badness.
I explained it a bit in my commit message:

```
It helps anyone looking at the code to understand that the variable
contains html and has been pre-escaped
```

This really comes in handy during code review, as it's obvious the variable contains html and cannot be escaped on output.