I was trying to use escape() to make user-provided URLs safe in<href=...> but I realized it was really only good for avoid starting tags, and not for escaping the content of a tag.

• escape() now escapes> as well as<
• URLs containing escaped<,> are now rendered correctly
• user-provided URLs should now be safe to use (as in they cannot break the formatting) as long as they're piped throughescape()
• possibly also resolves issues if you were trying to use user-provided colors i.e.'<'.OutputFormatter::escape($color).'>' where as in current released code it would not help you at all here. I haven't checked that yet

I am happy to spend time adding tests but would like to first get feedback on the changes to know if it's reasonable or not to changeescape() in this way.

The rest of the changes I think are absolutely safe to merge and make sense regardless.