util: Clean up module

Sort functions, add missing documentation, put exports at the bottom,
etc.
util: Remove pointless preventEventDefault function

This is called in three places and the call is longer than the function
body.
util: Remove unused contains function

This function is used in exactly one place by the test helpers module.
I've inlined it there.
util: Move maxZIndex to the one place it's used
plugin/defaultui: Don't stomp on String.prototype
plugin/defaultui: Minor doc tweak
util: Remove unused flatten function
util: rename escape -> escapeHtml to clarify intent
util: Tighten up escapeHtml

The HTML escape function didn't appropriately escape input for use in
attributes, and was unnecessarily forgiving of entities in input.
Without further caveats on its use (by plugins and otherwise) this poses
an XSS risk, so this commit tightens it up slightly.
util: Inline uuid in the only location it's used