The coverage HTML report has the same two defects the test report had #1254

Problem

Both defects fixed in the test report (#1249) exist in the coverage HTML report, which is a separate writer.

1. Filenames are joined and split on |

src/coverage/report_html.sh:92 builds each row as "$display_file|$hit|$executable|$pct|$safe_filename" and src/coverage/html_index.sh:319 splits it with IFS='|'. A source file whose name contains a pipe truncates:

$ bashunit --coverage --coverage-paths src/ --coverage-report-html cov t_test.sh
# console, correct:
src/a|b.sh                                 1/  1 lines (100%)

# cov/index.html:
class="file-name">a<          # should be a|b.sh
class="file-path">./src/a<    # should be ./src/a|b.sh

The coverage numbers are right; only the HTML display is wrong, and silently.

2. Filenames are written into the markup unescaped

$ ls src/
'a<b>c.sh'
# cov/index.html:
class="file-name">a<b>

The <b> is parsed as a tag and leaks into the rest of the document. & is more plausible in a real filename and produces invalid entity syntax (read&write.sh).

src/coverage/html_file.sh escapes the source lines it renders — its awk escape() covers &, <, >, which is right for element content. It is the filenames that go out raw, in both the index (link text, file path) and the per-file page (<title>, two spans).

Fix

Separate the row fields with US (0x1f) as the test report now does, and escape the filenames.

The escaping helper belongs in src/util/str.sh: util/index.sh is sourced before both coverage/ and reports/, so one bashunit::str::html_escape serves both and replaces the copy added to src/reports/html.sh in #1251 rather than leaving two.