Function argument names not escaped

[NeilFraser]

blocks/procedures.js line 175 is vulnerable to injection:

          '  <field name="NAME">' + this.arguments_[i] + '</field>' +

Create a function argument called <>, close the mutator, and reopen the mutator. Mutator crashes.

@BeksOmega In general, this is why XML (and HTML) should be built up node by node, rather than as dynamically-generated strings (with a comment above to show what the goal XML should be, since node building is not easily legible).

[NeilFraser]

Thanks for the quick patch!