Attributes should go through HTML::escape, not strip_tags

Problem/Motivation

It is currently not possible to output anything that resembles an HTML tag in an attribute using ui_patterns.

Looking at \Drupal\ui_patterns\Plugin\UiPatterns\PropType\AttributesPropType::normalizeAttrValue, the value goes through strip_tags but right after that, it goes in \Drupal\Core\Template\AttributeString::__toString to be HTML escaped.

On a larger scope, we should review all calls to strip_tags in the module and assess if it is appropriate.

Steps to reproduce

Using ui_suite_bootstrap, consider the following twig:

{# Case 1: using drupal attributes. #}
{% set foo_attr = 'Hello <em>world</em> and <<not-a-tag>> and <123> and <em2>OK</em2>.' %}
{% set btn_attrs = create_attribute({'data-foo': foo_attr}) %}
<button{{ btn_attrs }}>test</button>

{# Case 2: using SDC and ui_patterns. #}
{{ include('ui_suite_bootstrap:button', {
  label: 'test',
  attributes: {'data-foo': foo_attr}
}, with_context: false) }}

Raw output:

// Case 1: OK the attribute is html-escaped
<button data-foo="Hello &lt;em&gt;world&lt;/em&gt; and &lt;&lt;not-a-tag&gt;&gt; and &lt;123&gt; and &lt;em2&gt;OK&lt;/em2&gt;.">test</button>

// Case 2: NOK tags are stripped
<button data-foo="Hello world and  and  and OK." data-component-id="ui_suite_bootstrap:button" type="button">test</button>       

Proposed resolution

Possibly remove strip_tags entirely since attributes are already escaped in \Drupal\Core\Template\AttributeString::__toString

Remaining tasks

todo

User interface changes

N/A

API changes

N/A

Data model changes

N/A