Clone references before escaping?

As originally discovered in http://www.backup-manager.org/pipermail/dancer-users/2012-April/002424.html :

When `automatic_escaping` is enabled, we recursively encode HTML entities in template params, following references.

Since the app's settings are automatically passed to the template by `Dancer::Template::Abstract`, stored as a reference to the real settings hashref, we can inadvertently go HTML-encoding stuff in the app's actual settings.

A partial fix is for Dancer to clone the settings rather than storing an actual reference, but of course that still means the problem can occur in other cases.

For example:

``` perl
get '/' => sub {
my $foo = { foo => '' };
my $html = template 'bar', { foo => $foo };
# $foo->{foo} has been changed to <Foo>
};
```

Probably a safer fix is for `_encode` to automatically clone any reference it's about to change before making changes. This would need some refactoring in `_encode` to assume that it's starting with a hashref (which it will be) and to pass on both the key and the value each time, rather than simply passing the reference to the value when recursing.