Encode `<>"'&` properly, even with `useNamedReferences: false`