fix: use proper encoding for attr name / val pairs

[harlan-zw]

Issue

See #59

The encoding is too aggressive. it assumes that the value component of the attribute isn't quoted.

Properly quoted attributes can only be escaped with the corresponding quote.

Solution

Separately encode the attribute name more aggressively, stripping any unsupported characters.

For attribute values, we encode the " character to avoid escaping, and we use encode <> otherwise they will cause the HTML to be invalid.

If the intention of this encoding was to avoid XSS issues, then it's kind of pointless (see second test example). If we're simply encoding to avoid accidental scope scapes then this should be fine.

[harlan-zw]

Hey @pi0

Would you mind reviewing this one, some obvious overlap with the work you're doing but figured we should fix this bug sooner rather than later

[pi0]

I like current checks. On a related situation (in h3) made some changes to reduce aggressive encoding/escaping for src attr. The main issue was XSS so you might double-check but so far couldn't find any issue by only escaping " and <> for value.