Convert some phutil_escape_html() to hsprintf()

Summary:
In the second phase, I want to get rid of the most of phutil_escape_html() calls in favor of plain strings or PhutilSafeHTML.
This is an example of how it could look.

Test Plan: /api/user.whoami

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Maniphest Tasks: T2432

Differential Revision: https://secure.phabricator.com/D4823