Don't escape things in the htaccess.ejs template

it's not HTML, so just replace things as is.

Fixes the syntax in the CSP line

assets/.htaccess.ejs

-DirectoryIndex <%= getUrl(name + '.html') %>
+DirectoryIndex <%- getUrl(name + '.html') %>
 <FilesMatch "^(de|en|)$">
-    FallbackResource <%= getUrl(name + '.html') %>
+    FallbackResource <%- getUrl(name + '.html') %>
 </FilesMatch>
 
 Header set Cache-Control "must-revalidate, max-age=60"
-Header set Content-Security-Policy "<%= CSP %>"
+Header set Content-Security-Policy "<%- CSP %>"
 
 # Apache adds a "-gzip" suffix to the etag when it uses gzip but doesn't
 # take that into account when receiving requests.