packaging: make sure user content is properly escaped

We need to make sure all content in the JNLP/html and manifes is escaped as needed.

E.g. to pass < char in the application argument user should use &lt; in the ant task (this is because ant requires escaping) and as a result of that JNLP should contain &lt; too but manifest should contain < or perhaps \<.

This is potential source of inconvenience and subtle bugs.