convert basic escaping functions __()/_e() to esc_html__()/esc_html_e()

This is part of the larger discussion of improving escaping for security. Ref: https://github.com/Automattic/_s/issues/231. This is first pass so I've only modified strings that are simply strings, safe to esc_html.
Agreed.