Replace xml-escape

I stumbled upon this when trying to make sense of #192.

xml-escape can be removed when using the `escape` flag in jsontoxml. Escaping the whole .rdf file seems like a better solution to me, jpm should not create add-ons with invalid (unescaped) install.rdf files. Also less code.

Also added some tests for escaping. Hope they're in the right place.