Handle html encoded values in comment bindings

[jeremiahblanch]

Passing unencoded values in comments allows values such as --><script>alert(1)</script><!-- to be passed through and these will be executed by the browser. To prevent this, the values need to be html encoded, eg into "--><script>alert(1)</script><!--. Existing Quench won't decode these values.

This change uses the DOMParser to decode strings that include these escaped characters, so a comment binding like this works:

<!-- q-binding:fieldSpecs.fanEmail = {   &quot;name&quot;: &quot;fanEmail&quot;,   &quot;required&quot;: true,   &quot;type&quot;: &quot;email&quot;,   &quot;validationMessage&quot;: &quot;We really really need your email&quot; } -->