JS: polish js/incomplete-html-attribute-sanitization

[esbena]

I think the comment in the existing qhelp for js/incomplete-sanitization covers this case well enough.

Note, however, that this is generally not sufficient for replacing multi-character strings:
the String.prototype.replace method only performs one pass over the input string,
and will not replace further instances of the string that result from earlier replacements.