utils: Re-work xss_safe_string()

This function takes a string and returns that string with various
characters html encoded.

Rather than doing a small allocation (realloc) for each character in the
string (the string we return is a newly allocated string that may be
longer than the original), just do allocations in STR_ALLOC_SZ size's
(currently 512 bytes). This will usually mean just 1 malloc and no
realloc's instead of one malloc and lots of realloc's.

This is just cleaner overall and should also be more performant.

Signed-off-by: Andrew Clayton <andrew@digital-domain.net>