escape scope attribute names and values in DumpTag

[jmestwa-coder]

DumpTag (log:dump) writes the names and values of every attribute in the selected scope straight into the page:

• request- and session-scope attributes are routinely attacker-influenced (a request parameter copied into a request attribute, a form bean, etc.), so any page using log:dump with those scopes emits reflected/stored XSS
• doEndTag concatenated the attribute name and value into the HTML output with no escaping
• both are now escaped with StringBuilders.escapeXml before writing, the same escaping HtmlLayout and Log4j1XmlLayout already apply to event data

Checklist

• Base your changes on the 2.x branch
• ./mvnw verify succeeds for the affected module
• Changelog entry added under src/changelog/.2.x.x
• Tests are provided