escape commands in xml

allows to use use special chars like `'"&' in user commands.

```
mycommand.sh  'a string'  -> mycommand.sh &quot;a string&quot;
```
(openbox unescapes this)

More info:

https://wiki.python.org/moin/EscapingXml