This brings the API in-line with that of FormatText and FormatCSV and
allows it to be used without necessitating an intermediate buffer. The
change is fully backwards compatible and doesn't impose any potential
performance cost because `html.Template.Execute` accepts an io.Writer,
so any `bytes.Buffer` passed by reference to FormatHTML was already
being forced to escape onto the heap.

This might have been done this way to avoid questions about how the
function should handle errors from Writer, but we already ignore those
questions and panic in `FormatCSV`, so it seems reasonable that we would
do the same thing here.