xml.builder: generates XML for the server

we'll need to transform JSON request bodies into XML.
this is incomplete and not yet plugged in.
xml.builder: better support for XML attributes
xml.builder escapes <, >, &, ", ' in attribute values

text nodes will follow shortly.
xml.builder: CDATA support
xml.builder: bugfix in attribute handling

a tag callback can easily return a value (esp. in coffeescript)
which is not the expected hash of attributes for the current tag.
lib/lo/xml#transform -> lib/lo/xml#to_js

i need another name for the other direction as well.
tests/tools#parse -> tests/tools#parseXML

parseJSON is coming.
lib/lo/xml#from_js plus first request body transform

for PUT /appliances/:app/configuration.

also, tests/tools#parseJSON mirrors parseXML.

BTW, had to squash this in after rebasing on top of the slms
block addition:

GET /appliances/:app/configuration: slms may be missing

the failing test creates a JS object from a JSON file, converts
it into XML using the PUT endpoint (that's the "real" test), and
then tries to convert it back to JS with the GET endpoint for
good measure.  but the GET side expects full configuration in XML
while the PUT side permits partial requests (those configuration
subtrees which are present get updated, the ones missing from
the request are left as is).

i don't have time for a proper fix ATM, so here's a quick hack:
the GET /appliances/:app/configuration endpoint treats the slms
block as optional.
lib/lo/xml#to_js is async, should not throw

bowels wrapped in try/catch