directly print strings being XML-escaped instead of buffering

This simplifies the code by (a) removing the intermediate allocation (b)
streamlining the expression of what we mean.