Phalcon\Tag::escapeHtmlAttr() to properly escape HTML attributes

See #903