Escape filenames in GPX output

[Bolt4243]

GPX output inserts the input filename directly into the metadata and track name. A valid filename such as morning & afternoon.fit therefore produces malformed XML.

Escape the filename as XML text before writing either element. The regression parses a name containing both an ampersand and angle brackets, then checks that both elements retain the original text.

Tests: full unittest suite, workflow flake8 checks, and coverage run with 86% total coverage.