Escape generated password in mobileconfig

Escape ampersand, less than, greater than to avoid generating invalid XML.

Fixes #7171

data/web/mobileconfig.php

@@ -52,7 +52,7 @@ if (isset($_GET['app_password'])) {
   else
       $platform = $_SERVER['HTTP_USER_AGENT'];
 
-  $password = password_generate();
+  $password = htmlspecialchars(password_generate(), ENT_NOQUOTES);
 
   $attr = array(
       'app_name' => $platform,