CMS: fix XML compliance of `cms-tools-vm-image.xml`

* Fixes XML escaping problem that was introduced in
  2e720ab7735771555626828164f45e5fe289e396.

* Also, prefers to use "and" instead of "&". (see #357)

Signed-off-by: Tibor Simko <tibor.simko@cern.ch>