Flag Missed Escaping

[joshbetz]

We should flag missed escaping.

I do a check with ack, like:

ack 'echo \$'
ack 'echo get'

This finds a majority of missed escaping of variables as well as unescaped core functions. We should probably mark these as notes because there's likely to be some false positives.