xml escaping fixes

In addition to title and author, also attempt to escape call number values in ItemRequestedResponse messages.

Also, don't use HTML::Entities::encode as that can introduce HTML entities which are not valid built-in XML entities.