sync with MirBSD and tarent: proper CDATA escapes for JS and CSS