Document SafeMarkup::set and Use htmlspecialchars() directly in Attribute() so we don't bloat the list of safe strings

Cool idea!

This patch documents an acceptable use of SafeMarkup::set, replacing 4 SafeMarkup calls with htmlspecialchars() and only marking the final result as safe.

I did notice a comment in Attribute.php that needs to be updated:

 * The attribute keys and values are automatically sanitized for output with
 * \Drupal\Component\Utility\SafeMarkup::checkPlain().

read the whole patch,
and applied it and looked at it in context.

grepped for checkPlain in core/lib/Drupal/Core/Template
and after the patch, the only occurrence is TwigExtension
so, got all them out of the Attribute helpers. ok.

most of the replacements are of the pattern:

-    return $this->value === FALSE ? '' : SafeMarkup::checkPlain($this->name);
+    return $this->value === FALSE ? '' : htmlspecialchars($this->name, ENT_QUOTES, 'UTF-8');

and I was wondering how the args to htmlspecialchars was choosen, why ENT_QUOTES and UTF-8?

looking at checkPlain, can see that that is what checkplain was doing anyway, so that makes sense.

  public static function checkPlain($text) {
    $string = htmlspecialchars($text, ENT_QUOTES, 'UTF-8');
    static::$safeStrings[$string]['html'] = TRUE;
    return $string;
  }

got most of the (now) unused use's out... except for the one in AttributeArray.

I think if a patch with that out comes back ok, this is rtbc.

as long as it comes back green, rtbc.

Looks good. Also makes me think we might want a check plain that doesn't mark as safe, similar to what was being discussed in #2399261: Remove SafeMarkup::set and Recheck and Mark Safe the Output of Unicode::truncate() in DbLog. Not sure though.

This is another great cleanup to reduce SafeMarkup overuse. Thanks @pwolanin.

To clarify #12, checkPlain() is exactly htmlspecialchars($text, ENT_QUOTES, 'UTF-8') plus adding the string to the safe strings list. I checked with @pwolanin and it looks like the UTF-8 validation was added to htmlspecialchars() following PHP 5.2.5; @pwolanin linked: https://api.drupal.org/api/drupal/includes%21bootstrap.inc/function/chec...

Can we get a followup to either document on AttributeValueBase::render() (note there isn't an interface...) that child implementations are responsible for sanitizing values?

This issue is a required part of a critical task and is allowed per https://www.drupal.org/core/beta-changes. Committed and pushed to 8.0.x.