[6.x] Escape bound attributes passed to components from Antlers

[jacksleight]

This PR escapes bound attributes (:attr="..." and :$var) passed to components from Antlers, the same way Blade does.

At the moment the value goes into the attribute bag as-is, and the bag only backslashes quotes, so anything with a quote in it breaks the HTML:

{{ title = 'Say "hi"' }}
<x-button :data-title="title" />

<button data-title="Say \"hi\""></button>

Blade runs bound attributes through sanitizeComponentAttribute() when it compiles the component tag, Antlers was skipping that step.

Notes:

• Only bound attributes are escaped, literal ones are left as written, same as Blade.
• Props still receive the raw value.
• Bound attributes on named slots are escaped too.
• <x-dynamic-component> passes its attributes through unescaped, as Blade does, so they're only escaped once by the component it renders.
• The compiler passes the bound attribute names to the proxy tag in a component_bound___ param, alongside the existing component_name___.