Make base.html Mako template safe by default

Make base.html Mako template safe by default by:
1. Add page-level default of html escaping
2. Fix escaping of all variables in base.html
3. Fix escaping of all dependent underscore templates
Also includes additional best practices for certificates and
textbooks JavaScript/Underscore in order to complete that work.

TNL-3425

cms/static/js/certificates/views/certificate_editor.js

@@ -97,11 +97,11 @@ function($, _, Backbone, gettext,
             return {
                 id: this.model.get('id'),
                 uniqueId: _.uniqueId(),
-                name: this.model.escape('name'),
-                description: this.model.escape('description'),
-                course_title: this.model.escape('course_title'),
-                org_logo_path: this.model.escape('org_logo_path'),
-                is_active: this.model.escape('is_active'),
+                name: this.model.get('name'),
+                description: this.model.get('description'),
+                course_title: this.model.get('course_title'),
+                org_logo_path: this.model.get('org_logo_path'),
+                is_active: this.model.get('is_active'),
                 isNew: this.model.isNew()
             };
         },

cms/static/js/views/edit_chapter.js

@@ -12,8 +12,8 @@ define(["js/views/baseview", "underscore", "underscore.string", "jquery", "gette
         },
         render: function() {
             this.$el.html(this.template({
-                name: this.model.escape('name'),
-                asset_path: this.model.escape('asset_path'),
+                name: this.model.get('name'),
+                asset_path: this.model.get('asset_path'),
                 order: this.model.get('order'),
                 error: this.model.validationError
             }));
@@ -52,8 +52,10 @@ define(["js/views/baseview", "underscore", "underscore.string", "jquery", "gette
                 asset_path: this.$("input.chapter-asset-path").val()
             });
             var msg = new FileUploadModel({
-                title: _.template(gettext("Upload a new PDF to “<%= name %>”"),
-                    {name: course.escape('name')}),
+                title: _.template(
+                    gettext("Upload a new PDF to “<%= name %>”"),
+                    {name: window.course.escape('name')}
+                ),
                 message: gettext("Please select a PDF file to upload."),
                 mimeTypes: ['application/pdf']
             });

cms/static/js/views/edit_textbook.js

@@ -13,7 +13,7 @@ define(["js/views/baseview", "underscore", "jquery", "js/views/edit_chapter", "c
         className: "textbook",
         render: function() {
             this.$el.html(this.template({
-                name: this.model.escape('name'),
+                name: this.model.get('name'),
                 error: this.model.validationError
             }));
             this.addAll();

cms/static/js/views/show_textbook.js

@@ -29,8 +29,10 @@ define(["js/views/baseview", "underscore", "gettext", "common/js/components/view
             if(e && e.preventDefault) { e.preventDefault(); }
             var textbook = this.model, collection = this.model.collection;
             var msg = new PromptView.Warning({
-                title: _.template(gettext("Delete “<%= name %>”?"),
-                    {name: textbook.escape('name')}),
+                title: _.template(
+                    gettext("Delete “<%= name %>”?"),
+                    {name: textbook.get('name')}
+                ),
                 message: gettext("Deleting a textbook cannot be undone and once deleted any reference to it in your courseware's navigation will also be removed."),
                 actions: {
                     primary: {