Missing single quote escaping when singleQuotedAttributeValue is enabled

[mdk000]

Hello @leizongmin

After introducing new option with support for single-quoted attribute value syntax (#287) I've encountered a gap when this option is enabled.

During lack of escaping of single quote char in attribute value, we can pass a code like this:
<img src="/url' onerror='alert(1)'" /> and the output is <img src='/url' onerror='alert(1)'' /> which of course is not a result we wanted to be.

I've created a PR (#290) which adds an additional escaping for single quote char.

Please take a look

[mrwogu]

Hi @leizongmin, could you look at this?