Properly escape HTML.

Not escaping HTML could result in an XSS vulnerability.

* marmalade-service.el (safe-s-format): New function.
  (marmalade/package-blurb): User `safe-s-format', `xml-escape-string'
  in error case, and minor HTML fixes/changes.
* marmalade-tests.el (safe-s-format): New test.