Don't HTML-escape the assetPath with Mustache

Use Mustache's 3 curly braces to indicate that we don't want the assetPath variable to be HTML escaped.

The assetPath is referenced from inside the href attribute of link tags, and is generally formed of either a path or a URL containing a hostname.

Currently, the template outputs HTML like this:

    <link href="https:&#x2F;&#x2F;foo.service.gov.uk&#x2F;css&#x2F;stylesheets/govuk-template.css" />

This commit changes it to something more like this:

    <link href="https://foo.service.gov.uk/css/stylesheets/govuk-template.css" />

(See also alphagov/spotlight#497 for more context. I think we're seeing requests from badly behaved clients that don't interpret HTML escaped values inside `href`s correctly. Most clients seem to work fine.)