Escape translations and interpolated values

We should always assume that translations and the interpolated values
that are placed into that translation are malicious. This PR will escape
any html within these by default. You may unescape interpolated values
using the `unescape` option.
@twolfson this is in the third parameter so it won't conflict with the actual construct.