fix(ids): decode XML entities on load and escape values on export

[helenkwok]

Description

Fixes #817.

• Load: processEntities: true in IDSSpecifications.xmlParser, so &, <, >, " and ' are decoded. fast-xml-parser 5.7.2 keeps its default limits on entity expansion.
• Export: a small XML.escape helper in utils/xml.ts, used wherever the IDS export interpolates text: the info block, the specification's name, identifier, description and instructions, each facet's instructions, and simple, enumeration and pattern values.

Additional context

• New load-entities.test.ts: loading decodes entities in a specification name, a property set name and a value; and a load → export() → load round trip keeps R&D walls and Smith & Sons <Ltd>. The first test fails without the parser change, and the round trip fails with the parser change but without the escaping.
• vitest --run in packages/core: all pass. tsc -p tsconfig-build.json --noEmit is clean.
• If anyone escaped values by hand before setting them in code, they would now be escaped twice on export.
• Not changed here: the bounds export writes <xs:minInclusive value="…"> without closing the element, which is invalid XML on its own. I can open a separate issue for it.

---

What is the purpose of this pull request?

• Bug fix
• New Feature
• Documentation update
• Other

Before submitting the PR, please make sure you do the following:

• Check that there isn't already a PR that solves the problem the same way to avoid creating a duplicate.
• Follow the Conventional Commits v1.0.0 standard for PR naming (e.g. feat(examples): add hello-world example).
• Provide a description in this PR that addresses what the PR is solving, or reference the issue that it solves (e.g. fixes #123).
• Ideally, include relevant tests that fail without this PR but pass with it.