js api: escape & and = in all string config values (#260)

[phloxic]

Ampersands and equal signs in the static configuration break setups
completely, even where they are perfectly legal, like in urls.
Instead of trying to catch all properties which may be fed an url, apply
reduced escaping to all string values in the configuration.

This will not touch any dynamic settings where writing to the Flash
object on the html page is not involved, like
clip.update({url: "yadda?x=y"}) which is not an issue.

It is also not the same as the point blank url encoding which was tried
in 3.2.8 to detrimental effect, and therefore had to be backed out.

[phloxic]

@anssip - already did a lot of testing. imho this is safe, more consistent (almost elegant).
Here's a test page where it is used for playlist urls, clip.coverImage.url, menu.items and custom clip properties: http://flowplayer.dev/test/playlist-internal-audio.html