Escape HTML output and rebuild the JS validation generator

Two long-standing defects in the HTML exporter.

**Nothing was escaped.** Labels, help text, placeholders, values, select
and radio option labels, group and step titles all went into the markup
raw, so any form definition built from external data could inject
arbitrary HTML. Values interpolated into attributes could also close the
attribute and add their own (`" onclick="...`).

- Add `html_text()`, `html_attr()` and `attrs_to_str()` helpers, and route
  every interpolation through them.
- `attrs_to_str()` also filters attribute *names*, so a crafted key
  cannot introduce a new attribute.

**The client-side validation code was dead or broken.**

- `generate_validation_code()` returned `""` for every format except
  plain `"html"`, so no Bootstrap consumer ever had client validation.
  It is now generated for `html`, `html_bootstrap4` and `html_bootstrap5`.
- The script looked the form up by `form.name`, which is not what ends up
  in the `id` attribute. It now receives the exported id, and bails out
  quietly when the element is absent.
- Per-field code was emitted as `let {field.name} = ...`, a SyntaxError
  for any name that is not a JS identifier (`mi-campo`) or is a reserved
  word (`class`). Rules are now emitted as JSON and evaluated by a
  generic runtime, so field names are just data.
- Messages, labels and regex patterns are serialized with `json.dumps`;
  previously an apostrophe or a backslash broke the generated script.
- Values are read with a helper that handles checkbox and radio groups
  (where `form.elements[name]` yields a collection) and multiple selects,
  instead of assuming `.value`.
- The handler is attached with `addEventListener` rather than assigning
  `onsubmit`, which clobbered any other handler on the form, and is
  guarded against being attached twice.
- `validate_<form_name>(form)` is still exposed when the form name can be
  a JS identifier, so the previous entry point keeps working.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Juan Pablo Manson

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codeforms"
-version = "0.2.4"
+version = "0.3.0"
 description = "Python library for creating, validating, and rendering web forms using Pydantic"
 readme = "README.md"
 requires-python = ">=3.9"