fix GB2 double escaping issue with handlebars

GB2 uses htmlEscape method because it's mostly not dealing with handlebars, but
when it does deal with handlebars, it needs to use {{{ }}} since data has
already been escaped.

fixes CNVS-10121

test plan:
- enable avatars, and have a mix of students with and without them
- go to GB2
- you should see the avatars, and you should see a gray silhouette for the
  students that don't have one (not a blue power icon)
- basic regression test of other gradebook2 url links (including inside
  dialogs) to make sure they work correctly

Change-Id: I81cc15a87b296094d5b1d6b01e026aaddca4c0d4
Reviewed-on: https://gerrit.instructure.com/27768
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cameron Matheson <cameron@instructure.com>
QA-Review: Caleb Guanzon <cguanzon@instructure.com>
Product-Review: Simon Williams <simon@instructure.com>

app/coffeescripts/gradebook2/Gradebook.coffee

@@ -166,6 +166,7 @@ define [
             display_name: student.name
             url: student.enrollment.grades.html_url
             sectionNames: sectionNames
+            alreadyEscaped: true
 
           # fill in dummy submissions, so there's something there even if the
           # student didn't submit anything for that assignment

app/helpers/avatar_helper.rb

@@ -29,7 +29,6 @@ module AvatarHelper
       default_avatar
     end
 
-
     if !url.match(%r{\Ahttps?://})
       # make sure that the url is not just a path
       url = "#{request.protocol}#{request.host_with_port}#{url}"

app/views/jst/_avatar.handlebars

@@ -1,5 +1,17 @@
 {{#if this}}
   {{#if avatar_image_url}}
-    <a {{#if url}} href="{{url}}" {{/if}} class="avatar" {{#if display_name}} title="{{display_name}}" {{/if}}><img src="{{avatar_image_url}}" alt="{{display_name}}"></a>
+    {{#if alreadyEscaped}}
+      <a
+        {{#if url}}href="{{{url}}}"{{/if}}
+        class="avatar"
+        {{#if display_name}}title="{{{display_name}}}"{{/if}}
+      ><img src="{{{avatar_image_url}}}" alt="{{{display_name}}}"></a>
+    {{else}}
+      <a
+        {{#if url}}href="{{url}}"{{/if}}
+        class="avatar"
+        {{#if display_name}}title="{{display_name}}"{{/if}}
+      ><img src="{{avatar_image_url}}" alt="{{display_name}}"></a>
+    {{/if}}
   {{/if}}
 {{/if}}