Unescaped attributes

This fixes an issue where, say:

```
can.view.mustache("<foo title='{{hi}}'")({hi: "x&y"})
```

would render things such that `element.title === "x&amp;y"`

This makes it so that `{{{x}}}` and `{{x}}`, when applied to attributes, always do the exact same thing. It does not make sense for us to allow unescaped attribute values in `can.view`

EDIT: I found out after looking closer that this was only affecting things inside `{{#foo}}` blocks. This does fix that issue, and things continue to work as before. I've added a new test that specifically checks escaping inside blocks within attributes.