gh-149489: Fix ElementTree serialization to HTML

[serhiy-storchaka]

• The content of comments, processing instructions and elements "xmp", "iframe", "noembed", "noframes", and "plaintext" is no longer escaped.
• The "plaintext" element no longer have the closing tag.
• Add support of empty attributes (with value None).

• Issue: Fix ElementTree serialization to HTML #149489

[StanFromIreland]

Updating to fix some errors we introduced on the main branch.

[scoder]

I'm not done with the review yet, but I find it risky to silently change output in a point release like 3.1[34].x. If we change this, it's probably still fine for 3.15, but I'd rather see the maintenance releases excluded.

[serhiy-storchaka]

Well, the fix for XML was applied to 2.7 and 3.2 and was not backported to 2.6 and 3.1. It introduces a risk of XML/HTML injection if the comment content was not previously sanitized. See #149468.

[scoder]

The content of comments, processing instructions and elements "xmp", "iframe", "noembed", "noframes", and "plaintext" is no longer escaped.
[...] It introduces a risk of XML/HTML injection if the comment content was not previously sanitized.

Well, yes. If we remove the current escaping, then we leave user code unprotected. Definitely not something that users should expect from a point release.