Updated Y.ButtonCore's 'label' ATTR getter to HTML escape returned value
Improved labelHTML ATTR's security warning.