pub fn html_entity_encode(payload: &str) -> String
HTML entity encoding — each character becomes &#xXX;.
&#xXX;
Context: ONLY safe in HTML contexts where the browser decodes entities.