feat: html escape docstrings

DocGen4/Output/DocString.lean

@@ -210,11 +210,11 @@ partial def modifyElement (element : Element) : HtmlM Element :=
 
 /-- Convert docstring to Html. -/
 def docStringToHtml (s : String) : HtmlM (Array Html) := do
-  let rendered := CMark.renderHtml s
+  let rendered := CMark.renderHtml (Html.escape s)
   match manyDocument rendered.mkIterator with
   | Parsec.ParseResult.success _ res =>
     res.mapM fun x => do return Html.text <| toString (← modifyElement x)
-  | _ => return #[Html.text rendered]
+  | _ => return #[Html.text <| rendered]
 
 end Output
 end DocGen4

DocGen4/Output/ToHtmlFormat.lean

@@ -53,10 +53,10 @@ partial def textLength : Html → Nat
 
 def escapePairs : Array (String × String) :=
   #[
-    ("&", "&amp"),
-    ("<", "&lt"),
-    (">", "&gt"),
-    ("\"", "&quot")
+    ("&", "&amp;"),
+    ("<", "&lt;"),
+    (">", "&gt;"),
+    ("\"", "&quot;")
   ]
 
 def escape (s : String) : String :=