Escape HTML in table cells and headings

This protects users against XSS by default, if this output is not
desired, a custom formatter can be provided to replace it.
Sortable plugin now wraps the result of headerFormatter

This brings the formatter inline with user expectations. The formatter
is always called with the raw header value not a formatted block of
html from the plug-in. This keeps rules about escaping content clear,
if the user provides a formatter it is their responsibility to escape
html otherwise the library will do it.

Another benefit of this approach is that hacks/html parsing is no
longer required to add extra content inside the sortable anchor.
Add removeColumns plugin to the test suite
Escape input in the tabler.removeColumns plugin
Escape user input in columnGrouper plugin
Always pass escaped values into formatters
Merge pull request #31 from aron/formatters

Update formatters to escape HTML input by default