Stop HTML-escaping string values in JSON output

[VXNCXNX]

Fixes #552.

What's broken

JSON output escapes <, > and & as \uXXXX, so ordinary strings come back unreadable.

Repro

$ printf 'requires = ["setuptools>=77.0.3"]\n' | dasel -i toml -o json
{
    "requires": [
        "setuptools>=77.0.3"
    ]
}

The fix

goccy/go-json HTML-escapes by default, same as encoding/json. The writer now passes json.DisableHTMLEscape(). dasel transforms data rather than emitting HTML, so there is no injection context the escaping was protecting, and this matches what jq and similar tools output.

Blast radius is scalar values only. Object keys never reach this encoder, writeMap writes them with fmt.Fprintf.

After:

{
    "requires": [
        "setuptools>=77.0.3"
    ]
}

Verification

Added a round-trip test in parsing/json/json_test.go over a string holding >, < and &. It fails against the old writer with setuptools>=77.0.3 & <100.0 and passes with the fix. go test ./... is green. Also checked non-ASCII is unaffected: café → ok ✓ round-trips literally.

[TomWright]

Thanks for the PR. This is actually a duplicate of #556 but it isn't merged yet as I was waiting for a writer option to be able to turn this back on if needed

[VXNCXNX]

Ah, I missed #556 when I checked for open PRs, apologies for the duplicate. Happy to close this in favour of it.

On the writer option you are waiting for: the Ext map already looks like the right hook, since kdl-version, csv-delimiter and xml-mode all go through it and --ext-write wires it up for free. So something like

escapeHTML := w.options.Ext["json-escape-html"] == "true"

with MarshalWithOption(v, json.DisableHTMLEscape()) unless that is set, giving dasel -o json --ext-write json-escape-html=true for anyone who wants the old behaviour back.

Want me to push that onto #556, or open it as a follow-up so you can merge #556 first? Either is fine, and if you would rather do it yourself, no problem at all.

[VXNCXNX]

Closing this in favour of #556.

If it helps, the flag you asked for there looks like a small addition on top: json-escape read from the Ext map, same shape as csv-delimiter, with html keeping the old behaviour and anything else defaulting to off. --ext-write json-escape=html then works without extra wiring.

Happy to push that onto #556 or send it as a follow-up once that merges, whichever suits you. No need if you would rather keep it in-house.