Move to escape-html

* If there is a package that does exactly the same then lets us use that
* Import it properly in the internals (less deprecation warnings)

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>