feat(core) Use custom method htmlescape instead of htmlentities

This avoids repeating parameters at each call, and makes sure the same
 parameters are used for escaping across fusiondirectory.
This commit also adds escaping in some places where there was none.

issue #6071