fix: escape attributes

Following will be escaped from now on

- angle brackets
- quotes
- ampersands
- and a mix of them too

Author: vinitkumar

json2xml/dicttoxml.py

@@ -127,7 +127,7 @@ def make_attrstring(attr: dict[str, Any]) -> str:
     Returns:
         str: The string of XML attributes.
     """
-    attrstring = " ".join([f'{k}="{v}"' for k, v in attr.items()])
+    attrstring = " ".join([f'{k}="{escape_xml(v)}"' for k, v in attr.items()])
     return f'{" " if attrstring != "" else ""}{attrstring}'