o.c.scan: Update all ScanCommands to generate XML via DOM formatter.

This avoids problems with text that needs to be escaped, fixing #210.

To allow upload and download of scans with '&', '<', .. in SetCommand values to/from scan server, both the CSS GUI and the scan server need to be updated. Probably too much for an existing 3.2.x setup, so not a good candidate for a hotfix.