ui-refs: escape HTML chars in author and tagger names

Everywhere else we use html_txt to escape any special characters in
these variables.  Do so here as well.

Signed-off-by: John Keeping <john@keeping.me.uk>
ui-shared: URL-escape script_name

As far as I know, there is no requirement that $SCRIPT_NAME contain only
URL-safe characters, so we need to make sure that any special characters
are escaped.

Signed-off-by: John Keeping <john@keeping.me.uk>
ui-repolist: HTML-escape cgit_rooturl() response

This is for consistency with other callers.  The value returned from
cgit_rooturl is not guaranteed to be HTML-safe.

Signed-off-by: John Keeping <john@keeping.me.uk>