HTML encode attribute values

[dargmuesli]

Shouldn't this also encode & to &?

unhead/packages/ssr/src/util/propsToString.ts

Lines 1 to 3 in 955ce57

	function encodeAttribute(value: string) {
	return String(value).replace(/"/g, '"')
	}

Maybe just run the full escapeHtml on it?

I noticed because Nuxt's html validator module pointed out that a link like <link href="/_ipx/f_webp&s_4162x6018/header.jpg"> includes an invalid "&s", i.e. ampersand.