Escape generated password in mobileconfig

Escape ampersand, less than, greater than to avoid generating invalid XML.

Fixes #7171

data/web/mobileconfig.php

@@ -65,6 +65,7 @@ if (isset($_GET['app_password'])) {
       $attr['protocols'][] = 'dav_access';
   }
   app_passwd("add", $attr);
+  $password = htmlspecialchars($password, ENT_NOQUOTES);
 } else {
   $app_password = false;
 }