Escape attribute values

To prevent cross-site-scripting and other problems, escape attribute values as they're serialised.

I've provided an example using `scala.xml`, but there are many other libraries out there that may provide suitable escaping functions.