Fix multiple escape bugs in m_httpd_stats.

- Fix channel names not being sanitised which could result in invalid XML being created.
- When data can not be represented in XML (e.g. color codes), the entire string is now base64 encoded and wrapped in a CDATA instead of being escaped invalidly.