fix(html_tag): escape html and encode url by default

[curbengh]

Related to hexojs/hexo#3704 (cc @dailyrandomphoto)
This is to transform

<a href="/posts/test1/" title="this is a title with <a tag>.">this is a text with </a><a tag="">.</a>

to

<a href="/posts/test1/" title="this is a title with &lt;a tag&gt;.">this is a text with &lt;/a&gt;&lt;a tag=""&gt;.</a>

There is an option to disable escape just the text.

htmlTag('a', {href: 'http://foo.com'}, '<b>bold</b> text', false)

<a href="http://foo.com"><b>bold</b> text</a>

[coveralls]

Coverage increased (+0.05%) to 96.491% when pulling 9c8bfe2 on curbengh:escape-html into 968a91b on hexojs:master.

[curbengh]

Just updated docs.

[dailyrandomphoto]

It's not safe to escape attributes when which value is url.
e.g.

data-url="http://example.com/"
=>
data-url="http://example.com/"

I think escape " is enough.

else result += ` ${escapeHTML(i)}="${String(attrs[i]).replace(/"/g, """)}"`;

[dailyrandomphoto]

Can you add these test cases.

  it('tag + data-attrs', () => {
    htmlTag('foo', {
      'data-url': 'http://example.com/'
    }, '<baz>').should.eql('<foo data-url="http://example.com/">&lt;baz&gt;</foo>');
  });

  it('tag + bad attrs', () => {
    htmlTag('foo', {
      'bar': 'bar" class="badclass'
    }, '<baz>').should.eql('<foo bar="bar&quot; class=&quot;badclass">&lt;baz&gt;</foo>');
  });

  it('nested tags', () => {
    htmlTag('div', {
    	'class': 'parent'
    }, htmlTag('a', {
    	'href': 'http://example.com/'
    }, 'link'), false).should.eql('<div class="parent"><a href="http://example.com/">link</a></div>');
  });