Escape single quote (') characters as '

[RyanGlScott]

Currently, stache escapes only four of the five XML entities that need to be escaped, as it does not escape single quotes (') as '. (Alternatives include ' and ', but they aren't as widely supported on as many browsers as '.)

I originally noticed this because microstache (a fork of stache) does not escape single quotes when substituting into criterion's HTML report, which is the root cause of this bug.

(Credit goes to JustusAdam/mustache#28 for this idea.)