[6.x] Add safe option to to_json for HTML-embedded JSON

[edalzell]

Summary

Bare json_encode output (what to_json uses today) can allow strings containing </script> to break out of HTML <script> elements, including application/ld+json. Laravel’s @json / Js::from() already apply the JSON HEX flags; Antlers had no equivalent.

This adds an opt-in safe parameter so existing to_json output stays unchanged:

• {{ value | to_json:safe }}
• Combinable in either order: {{ value | to_json:pretty:safe }} or {{ value | to_json:safe:pretty }}

When safe is present, encoding uses JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT.

Modifier docs live in the separate docs repo and need a follow-up update.

Test plan

• Existing to_json / to_json:pretty output unchanged
• to_json:safe hex-encodes HTML-sensitive characters and does not contain raw </script>
• Safe output json_decodes back to the original value
• pretty and safe work together in either param order