appium-mcp: Stored/Reflected XSS in createLocatorGeneratorUI

The `createLocatorGeneratorUI` function in `src/ui/mcp-ui-utils.ts` interpolates attacker-controlled element attributes (`text`, `content-desc`, `resource-id`, and locator selector values) directly into an HTML template literal without HTML or JavaScript context escaping, leading to stored/reflected XSS.

Any developer using `appium-mcp` with an MCP client that renders HTML resources (e.g., VS Code with Appium MCP extension) and inspecting elements from an attacker-controlled application.

Apply HTML-escaping to all element properties in the HTML context and use `JSON.stringify` for values embedded inside JavaScript string literals in `onclick` handlers.