[core] Safer XML escape