Fix codegen build (toml 0.9 broke things), improve v_htmlescape behaviour (don’t encode slash)

[chris-morgan]

Read the commit messages for more detail.

Why the v_escape_codegen@0.1.9 → 0.1.8? Dunno, haven’t delved.

[zzau13]

Thanks for the PR @chris-morgan, and sorry for the late reply.

After thinking this over I'm going to go in a different direction, so I'll be closing this one. Here's the plan and reasoning:

Two crates instead of changing the existing behaviour in place

Rather than mutating v_htmlescape's output, I want to ship two HTML-escape libraries side by side:

1. One preserving the historical 6-char set (<, >, &, ", ', /) with ' — current v_htmlescape behaviour, kept for backward compatibility.
2. One following the current OWASP XSS Prevention Cheat Sheet, Rule #1 — 5-char set, no /.

Notes on the entity choices in this PR:

• Dropping / for /: agreed — matches current OWASP guidance. This will be the behaviour of crate add support for character in hexadecimal, octal and numbers ascii #2.
• ' for ': I'd push back on this. ' is not defined in HTML 4.01 (only XML/XHTML); OWASP explicitly recommends ' / ' for cross-parser safety. Both crates will keep '.

Codegen rework first

Before adding the second crate I want to land some codegen improvements that have been pending:

1. Add the OR operation to the set of operations the codegen can pick from — the current search space misses patterns that benefit from a fused-OR mask.
2. Backtracking-based operation generator, replacing the current greedy selection with a real search over valid operation sequences.
3. Minimax-style scoring to pick the best sequence for a given input set (worst-case cost as the metric, so we don't regress the hot path while improving the average).

The toml 0.9 fix in 9529be0 is independently useful — I'll bring it in (with attribution) when I land the codegen rework so it doesn't get lost.

TL;DR — closing in favour of: (1) codegen rework (OR op + backtracking + minimax selection), then (2) two coexisting HTML-escape crates (legacy 6-char + modern 5-char OWASP), both keeping '. Thanks again — the slash change and the toml fix were on the right track.