escape < and & in attributes

doc.stag was not escaping < and &

patched attr_escape to always escape < and & which is required according to:

http://www.w3.org/TR/xml/#NT-AttValue

also use attr_escape in dict_to_attrs