Fix escaping issues with the new Markdown support.

Text normalized for edit worked fine when being injected straight into
JavaScript code using the normalize_text_for_edit template tag, but it
didn't work so well for data-raw-value= attributes, nor did it work for
comment arrays for review UIs/diff viewer.

We now default to HTML-escaping text, and only turn this off in the case
where we're outputting to JavaScript code using the template tag.

This prevents things like &amp; from turning into &, and double quotes
from breaking data attributes.

Unit tests were added to cover the various cases.

Reviewed at https://reviews.reviewboard.org/r/6568/