fix: harden html attribute escaping

[cssbruno]

Summary

• Use the HTML-template escaper for generated HTML attribute values.
• Reject unsafe generated attribute names before rendering an attribute.
• Add regression coverage for JSON attribute values containing quotes, HTML markup, and ampersands.

This addresses the CodeQL alert on runtime/html/html.go for potentially unsafe quoting in generated HTML attributes.

Verification

• I ran the relevant tests, lint, and build commands.
• I ran scripts/test-go-modules.sh when Go code or compiler behavior changed.
• I ran go build ./cmd/gowdk when CLI, compiler, runtime, addon, or release behavior changed.
• I ran node --check editors/vscode/extension.js when editor files changed.
• I updated docs for behavior, setup, or architecture changes.
• I added or updated tests for changed behavior.

Additional validation:

• go test ./runtime/html
• git diff --check
• go test ./...

LLM Assistance

• LLM session summary: Codex fixed the CodeQL HTML attribute quoting finding with a scoped runtime helper change and regression tests.
• Human-reviewed assumptions: Pending maintainer review before merge.
• Follow-up work: Re-run GitHub CodeQL on the PR to confirm the alert closes in GitHub Security.