fix(mail): escape mail data placed in attributes of a compiled part

the generic attribute writer used for these two spots does not escape what it
writes, so a value taken from the message ends the attribute and starts a new
one. both are inside a part that is compiled, which is where an injected
handler runs.

* the organizer link took inEvent.organizer.email verbatim. a value such as
  mailto:x@y" onpointerover="... produced a live handler on the anchor, and an
  entity encoded scheme such as javascript: reached the href, where the
  browser decodes it. the href is now built as mailto: plus the parsed address
  and escaped as an attribute value.

* the attachment name paragraph of the image and the link viewer took
  filenameForDisplay verbatim. a quote inside an RFC 2231 encoded filename
  ended the title attribute. the writer escapes & < > there but not the quote,
  so the accessor drops the quote instead of escaping it, which keeps a plain
  filename such as A&B.pdf unchanged in the tooltip.

the img title of the image viewer is left alone: attributes of that element are
escaped by the framework already.

UI/MailPartViewers/UIxMailPartViewer.m

@@ -340,6 +340,14 @@
     : (id)@"untitled";
 }
 
+- (NSString *) filenameForTitle
+{
+  /* the generic attribute writer escapes & but not the quote, so a quote in the
+     filename would end the title attribute and start a new one */
+  return [[self filenameForDisplay] stringByReplacingOccurrencesOfString: @"\""
+                                                             withString: @""];
+}
+
 - (NSFormatter *) sizeFormatter
 {
   return [UIxMailSizeFormatter sharedMailSizeFormatter];