Invalid escaping in renderBaseAttrs()

Summary:
Second parameter of htmlspecialchars() is flags (int), not bool.
Value true is understood as 1 which means: quote single quotes, not double quotes

Test Plan:
New test

php-lib/html.php

@@ -65,7 +65,7 @@ protected final function renderBaseAttrs() {
     $buf = '<'.$this->tagName;
     foreach ($this->getAttributes() as $key => $val) {
       if ($val !== null && $val !== false) {
-        $buf .= ' ' . htmlspecialchars($key) . '="' . htmlspecialchars($val, true) . '"';
+        $buf .= ' ' . htmlspecialchars($key) . '="' . htmlspecialchars($val) . '"';
       }
     }
     return $buf;

tests/attr-quotes.phpt

@@ -0,0 +1,9 @@
+--TEST--
+Quotes in attribute
+--FILE--
+<?php
+class xhp_a {}
+$quote = '"';
+echo <a b={$quote}>c</a>;
+--EXPECT--
+<a b="&quot;">c</a>