Use cgi.escape for comment escaping.

jinja2.escape escapes too much (quote marks) for things
that aren't going to be placed in attribute values.

backport of
  e326c44

buildbot/status/web/base.py

@@ -597,7 +597,7 @@ def replace_from_tuple(t):
         link_replace_re = jinja2.Markup(r'<a href="%s"%s>\g<0></a>' % (url_replace, title_replace))        
 
         def filter(text, project):
-            text = jinja2.escape(text)
+            text = cgi.escape(text)
             html = search_re.sub(link_replace_re, text)
             return html
 
@@ -615,7 +615,7 @@ def dict_filter(text, project):
             if t:
                 return replace_from_tuple(t)(text, project)
             else:
-                return jinja2.escape(text)
+                return cgi.escape(text)
 
         return dict_filter
 
@@ -624,7 +624,7 @@ def dict_filter(text, project):
 
     elif callable(changelink):
         def callable_filter(text, project):
-            text = jinja2.escape(text)
+            text = cgi.escape(text)
             return changelink(text, project)
 
         return callable_filter