Escape translations and interpolated values

We should always assume that translations and the interpolated values
that are placed into that translation are malicious. This PR will escape
any html within these by default. You may unescape interpolated values
using the `unescape` option.
Can we add a large section explaining the XSS vuln this is patching?

-------------------------
## Problems `express-translate` solves
- Use keys over indicies for translation values, increasing translation flexibility
- Patches XSS vulnerabilities for malicious translations/values

We solve the following XSS vulnerabilities:

### Malicious translations
If your translations are performed by malicious translators, then they could contain XSS attacks

```
// Define an translation with dynamic HTML content
!= t('welcome', {welcome_link: '<a href="/">' + user.name + '</a>'})

// Inside a translation
Hello <script>alert(1)</script>! Access your dashboard via ${welcome_link}
```

We prevent this by escaping the entire string:

```
Hello &lt;script&gt;alert(1)&lt;/script&gt;! Access your dashboard via ${welcome_link}
```

### Malicious keys
If the malicious translators are smart, then they can provide a bad key which will not get replaces

```
Hello ${<script>alert(1)</script>}! Access your dashboard via ${welcome_link}
```

We prevent this by escaping the entire string:

```
Hello ${&lt;script&gt;alert(1)&lt;/script&gt;}! Access your dashboard via ${welcome_link}
```

### Malicious values
If the end user is being malicious, then they can provide a malicious value:

```
// Normal translation execution
!= t('welcome', {welcome_link: '<a href="/">' + user.name + '</a>'})
Hello! Access your dashboard via ${welcome_link}

// With XSS attack
var user = {name: '<script>alert(1)</script>'};
// Hello! Access your dashboard via <a href="/"><script>alert(1)</script></a>
```

We prevent against this by escaping every value

```
Hello! Access your dashboard via &lt;a href=&quot;/&quot;&gt;&lt;script&gt;alert(1)&lt;/script&gt;&lt;/a&gt;
```

Unfortunately, this is undesired side effects with HTML so we provide a way to trust specific translations via the `_escape` key. This allows us to provide a recursive solution:

```
// Translate welcome link
- var welcome_link_text = t('welcome_link_text', {name: user.name})
${name}

// Translate welcome message
!= t('welcome', {welcome_link: '<a href="/">' + welcome_link_text + '</a>', _unescape: ['welcome_link']})
```

yielding:

```
Hello! Access your dashboard via <a href="/">&lt;script&gt;alert(1)&lt;/script&gt;</a>
```