Fix unescape attributes in Stylesheet.__str__

[Baptiste Mispelon]

_{This was originally reported by Mustafa Barakat as a security issue but was deemed low-risk enough to be tracked publicly.}

The django.utils.feedgenerator.Stylesheet class (introduced in #12978) has a __str__ method which is used when outputting a <?xml-stylesheet ... ?>. The method uses f-strings with three different attributes: url, mimetype, and media.

However these attributes are not escaped, which could potentially lead to invalid markup if any of those attributes were to contain a quote for example.

Escaping using Django's escape (or even format_html) should work even though those functions are meant for HTML and not XML.