The class of `CGI.escapeHTML` result

The class of `CGI.escapeHTML` result is not consistent for escaped/non-escaped cases.

```ruby
require 'cgi/escape'
class S<String;end
p %w[a &].map {|c|[c, CGI.escapeHTML(S.new(c)).class]}.to_h #=> {"a"=>S, "&"=>String}
```

Probably, should be `String` always?