Use JOSM built in XML escape methods.

Probably not quite as correct but including jar files in plugin builds
is prolematic.