Replace cgi.escape() with html.escape()

cgi.escape() was removed in Python 3.8. Replace it with html.escape(), passing quote=False where the call gave no quote argument, since html.escape() escapes quotes by default and cgi.escape() did not. An explicit quote argument is kept as it is, and where it is true html.escape() also escapes ', which cgi.escape() left alone. A file that also refers to cgi.escape other than by calling it, or calls it with unpacked *args or **kwargs, is left as it is, with those references marked for a manual change, as are the calls in a file that binds html to something else. A file that never calls it is not visited.