make XSS test comprehensive

This also lets the test pass under Plack versions prior to 1.0002, where
Plack::Request would percent-encode the ampersand, causing the previous
formulation of the test to fail.

In fact, no potentially HTML-unsafe character would ever be passed thru
verbatim under the old behaviour, which makes it tricky to test whether
Plack::Middleware::Rewrite has operative HTML escaping.

But the tests should not be relying on a specific choice of escaping on
the side of Plack either. So test *all* sensitive characters, and check
if they are covered in one way or the other, making this a conceptual
test for XSS vulnerability independent of the specific implementation.