Usernames are not XML-char safe

[gravitystorm]

Usernames are changed directly through the web site, and don't go via the API. This means they can contain non-XML safe characters.

This isn't a problem using any XML API or dump, but could cause problems with e.g. history dumps.

They should be stripped of non-XML characters, c.f.

openstreetmap-website/app/controllers/amf_controller.rb

Line 883 in d27cc80

# strip characters which are invalid in XML documents from the strings

[tomhughes]

I've excluded the basic ASCII control characters in 32c385e.

[tomhughes]

I've blocked the byte order markers as well now, in 0cc579b.

The only other thing we should be blocking is surrogates, but ruby literally won't let you write them as a range, presumably because it insists on them appearing as a valid pair which it would then decode into a single codepoint, so it's likely it will do the same if receiving them from the network.