gravatar_link(): escape alt and title
gravatar_link(): escape alt and title

These are set to the user's email, or display name.

When testing the escaping in user_form.php,
gravatar_link() also let unescaped HTML through.
Luckily this happened to result in invalid html,
which showed up in the html validator.

kelaskakap/cms-api-unggun,kelaskakap/cms-api-unggun,PeterRock/Ci-Bonfire3,kelaskakap/cms-api-unggun,PeterRock/Ci-Bonfire3,PeterRock/Ci-Bonfire3