Add esc_url() to header_image()

[SergeyBiryukov]

Spotted this in Twenty Thirteen: esc_url( header_image() ) (see #23663).

It doesn't work as intended, since header_image() echoes the value directly:
http://core.trac.wordpress.org/browser/tags/3.5.1/wp-includes/theme.php#L983

I guess we should add esc_url() to header_image() itself, like we did in [14949] for the_guid() and in [23527] for the_permalink().

In 23633:

Always escape the URL echoed by header_image(). fixes #23664.