Preserve already escaped attributes values to prevent double escaping

[colinrotherham]

This PR closes #4940 and fixes safe and escape filtered values in govukAttributes()

The previous fix in #4938 missed that JSON.stringify() in renderMacro() is what breaks instanceof checks

<div {{- govukAttributes({
  'data-text': 'Testing',
  'data-unsafe-text': 'Testing & more',
  'data-safe-text': 'Testing &amp; more' | safe,
  'data-escaped-text': 'Testing & more' | escape
}) }}>

We can now use the Nunjucks is escaped test instead of only is mapping

[colinrotherham]

Worth a mention, some JavaScript-only syntax is creeping in to your Nunjucks

I've limited changes in this PR to only govuk/macros/attributes.njk but watch out for:

• Strict equals, === versus is sameas(true)
• Defined checks !== undefined versus is not undefined
• Array methods [x, y, z].includes() versus in [x, y, z]

Depends how strict Nunjucks v4 ends up being

[colinrotherham]

The macro also didn't handle being called directly with a string made safe

{{- govukAttributes(' data-attribute="Testing & more"' | safe) -}}

Sadly it passes the is mapping check but lacked is not escaped to prevent this:

    Expected: " data-attribute=\"Testing & more\""
    Received: "  =\"\" d=\"\" a=\"\" t=\"\" a=\"\" -=\"\" a=\"\" t=\"\" t=\"\" r=\"\" i=\"\" b=\"\" u=\"\" t=\"\" e=\"\" ==\"\" "=\"\" T=\"\" e=\"\" s=\"\" t=\"\" i=\"\" n=\"\" g=\"\"  =\"\" &=\"\" a=\"\" m=\"\" p=\"\" ;=\"\"  =\"\" m=\"\" o=\"\" r=\"\" e=\"\" "=\"\""

That's all fixed now too and tests updated

[owenatgov]

@colinrotherham Would you be willing to change the target of this to support/5.x? If it's a hassle I'm happy for this to go through normal review and then backport it myself.

[colinrotherham]

@owenatgov Done

[owenatgov]

Code looks grand 👍🏻 Thanks for this @colinrotherham

One pithy thing is that this needs a fix changelog entry. After that I'll approve.

Finally this just needs a second review. I'll ping the other devs as reviewers on ths.

[colinrotherham]

Good job I know you, thanks @owenatgov

Changelog entry pushed

[domoscargin]

This looks good to me!