HTML escaping should not try to be reentrant

The `escape` filter currently tries to be reentrant by not converting entities like `&amp;` if they are already converted.

This prevents the use of literal entities in plain text strings, and is just not the expected semantics of a "plain-text to HTML" escaping mechanism.

This PR fixes the escape filter and update the tests.