fix: XML-escape the complete error message in machine-readable mode

Previously we were only escaping the format string which was not only
insufficient, but probably also wrong. We now construct the entire error message
and then escape it.

Github: closes #133 "invalid XML when expression contains sensitive characters"