html: properly percent-escape URLs

The only valid characters for a URL are unreserved characters
a-zA-Z0-9_-.~ and the reserved characters !*'();:@&=+$,/?%#[] , as per
RFC 3986.  Everything else must be escaped.  Additionally, the # and
? always have special meaning, and the &, =, and + have special meaning
in a query string, so they too must be escaped.  To make this easier,
a table of escapes is now used so that we do not have to call fmt() for
each character; if the entry is 0, no escaping is needed.

Signed-off-by: Mark Lodato <lodatom@gmail.com>