fix(atom): escape & in category attribute values

[greymoth-jp]

The Atom renderer puts category values into attributes (<category term="..."/> for feed-level categories, and label/scheme/term for item categories) and hands them to xml-js unescaped.

xml-js escapes & inside element text but not inside attribute values, so a category containing an ampersand produces non-well-formed XML:

feed.addCategory("Arts & Crafts");

feed.atom1(); // <category term="Arts & Crafts"/>   raw &, rejected by strict XML parsers
feed.rss2();  // <category>Arts &amp; Crafts</category>   escaped, valid

The RSS2 renderer already escapes the same value because it emits the category as element text, where xml-js does escape &. So the two formats disagree for identical input, and the Atom output is invalid.

This applies the existing sanitize() helper to the category attributes, the same approach used for enclosure URLs in #228. Feed-level snapshots are unchanged because the sample categories contain no &. Added a test covering the feed-level term and the item-level label/scheme.