fix(documentai-toolbox): enable autoescape in export_hocr_str

[Samin061]

export_hocr_str builds its Jinja2 Environment without autoescape, so the title argument is written into the <title> element unescaped. A title such as </title><script>alert(1)</script> breaks out of the element and lands as raw script markup, producing invalid XML in an hOCR document that is meant to be valid XHTML rendered in a browser. The word and line text already pass through the escape filter, so enabling autoescape closes the remaining gap inside the helper while leaving the output byte-identical for normal input (existing golden-file tests are unchanged).

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)

[gemini-code-assist]

Code Review

This pull request enables autoescaping (autoescape=True) in the Jinja2 environment within export_hocr_str to prevent potential injection vulnerabilities, and adds a corresponding unit test test_export_hocr_str_escapes_title to verify that HTML/XML tags in the title are properly escaped. There are no review comments, so I have no feedback to provide.

[parthea]

Thanks @Samin061!

[hebaalazzeh]

LGTM!