feat: add String escape and unescape.

Uses `String.replace` to escape HTML for attributes and inputs. This seems to be the simplest and most performant method. Works the same was a lodash but unraveled from the anarchy of [that file](https://github.com/lodash/lodash/blob/4.17.15/lodash.js#L14251).