Fix XSS in EncodingVisualizer HTML attributes

[varneeth01]

What does this PR do?

This PR fixes an HTML attribute injection vulnerability in
bindings/python/py_src/tokenizers/tools/visualizer.py.

While visible text was already escaped by the earlier fix in #1937, several
data-* attribute values were still constructed directly from untrusted token
or annotation text. A malicious value containing quotes could terminate the
attribute and inject additional HTML attributes or elements when the generated
HTML was rendered.

This change:

• escapes all user-controlled HTML attribute values using
  html.escape(..., quote=True)
• quotes the previously unquoted data-stoken attribute
• preserves existing rendering behavior
• adds regression coverage to prevent future regressions

Fixes

Fixes #2210

Testing

• Added regression tests covering malicious token text
• Added regression tests covering malicious annotation labels
• Verified that injected quotes are escaped and cannot create new HTML attributes
• Verified that normal rendering remains unchanged

[varneeth01]

Escape all user-controlled values inserted into HTML data-* attributes in EncodingVisualizer. Previously, visible text was escaped but attribute values were not, which could allow malformed HTML or script injection if token or annotation values contained special characters.