util: Escape raw HTML

We don't want random users to write whatever HTML in comments.
tests: Ensure markdown escapes raw HTML