fix: non-printable characters in XML

[BeksOmega]

The basics

• I branched from develop
• My pull request is against develop
• My code follows the style guide
• I ran npm run format and npm run lint

The details

Resolves

Fixes #4590

Proposed Changes

Makes it so that non-printable characters are properly escaped when serializing to XML, and that we do best-effort parsing when deserializing unescaped characters.

Reason for Changes

App Inventor needs this to be pulled into core for them to be able to update.

Test Coverage

Unit tests for serializing and deserializing.

Documentation

N/A

Additional Information

N/A

[cpcallen]

I have so many questions about this, starting with: is XMLSerialzer really specced to return invalid XML which can't be parsed with DOMParser???

[BeksOmega]

I have so many questions about this, starting with: is XMLSerialzer really specced to return invalid XML which can't be parsed with DOMParser???

In the previous PR fixing this, Neil had the same question: #4945 (review)

[cpcallen]

Additional comments about textToDom, after discussion with Neil (but don't blame him if you don't like them!):

• AFAICT there's no reason to ever create more than one DOMParser (or XMLSerializer) instance, so I suggest having the module create a single module-local one and use it everywhere.
• textToDomDocument is only used by textToDom in this module (and nowhere else), so I suggest it be deprecated and have textToDom always use (the) DOMParser (instance) directly.
• I'm unclear about why textToDom tries parsing as HTML if parsing as XML fails. That seems risky, and at least deserves an inline comment if not a note in the JSDoc.
• Normally I prefer handling errors at the top with an if (fail) return;, but in this case the error handlers end up getting nested, so I think it would be clearer to rewrite as:

  try xml
  if (xml win) return xml
  try html
  if (html win) return html
  throw 'I give up';

[NeilFraser]

Note that these tests still use hex.

[BeksOmega]

@cpcallen Ok I think this is actually good for another look!

[cpcallen]

LGTM except for some nit-picking about the tests.

In addition to the specifics below, I think it would be wise to check all of the invalid characters in the tests (especially \x00).