[jay23606]

Fixes #13.

Bug

Setting values and item attributes (name, category, class_name, comment, schedule) in _production_definition.py were interpolated into the generated production XML with no escaping. A value containing &, <, > or " (for example FilePath: "/data/input&output") produced invalid XML, which fails to compile on the IRIS side.

Change

• Added a small _xml_escape helper built on the standard library xml.sax.saxutils.escape, which also escapes " to " so it is safe in attributes.
• Applied it to <Setting> values in _create_item_target_settings and to the item attributes in _create_production_item.
• No new dependencies. Production-level settings (Description) are not changed.

Testing

• Added tests/test_xml_escaping.py. It stubs the iris module, builds a ServiceItem with special characters in its name, comment and adapter setting, and checks that the generated XML contains the escaped forms.
• python -m pytest tests/test_xml_escaping.py -q passes with the fix (1 passed).
• The same test fails against the unescaped code (1 failed, reporting an unescaped item name), so it covers the regression.
• The full suite needs an IRIS installation, which is not available in this environment, so it was not run.

Regression test: fails on base twice (/unescaped (item name|item comment|setting value)/), passes on fix twice (python -m pytest tests/test_xml_escaping.py -q)

Fixes #13