Fix/escape XML characters in sitemap url

[Austin1serb]

What?

Fixes an issue where sitemap.[ts/js] generates invalid XML when URLs contain special characters like &, <, >, ", and '. While the source file is JavaScript or TypeScript, the final output is XML — which requires strict character escaping.

See: #77340

Why?

Unescaped characters break XML parsing, causing search engines to reject the sitemap or ignore URLs. While some users manually escape these (& → &), this leads to brittle workarounds and potential double-escaping.

How?

• Added a new utility: escapeXmlValue()
  • Escapes special XML characters
  • Prevents double-escaping by detecting existing valid entities (e.g., &)
• Applied this utility in resolveSitemap() for <loc> values
• Added tests to ensure:
  • Proper escaping of raw characters
  • No double-escaping of already-escaped entities

This fix maintains backward compatibility for users who have already manually escaped their URLs.

Fixes #77340

[ijjk]

Allow CI Workflow Run

• approve CI run for commit: 8030db3

Note: this should only be enabled once the PR is ready to go and can only be enabled by a maintainer

[Austin1serb]

I Added the Function to this utils file because it was already being used/imported in resolve-route-data.ts.

[Austin1serb]

💡 Note on unrecognized HTML entities
This fix only escapes standard XML-safe characters (&, <, >, ", ') and prevents double-escaping of valid entities like &.

It does not warn if the input contains unsupported HTML entities like ©,  , etc. — those will be escaped as &copy;, which renders literally in XML.

If needed, a warning or validation layer could be added in the future to detect and notify about non-XML entities. For now, this is intentionally left silent to avoid unnecessary noise or breaking existing behavior.

[Austin1serb]

I wrote the tests in the current generate sitemap test block