escape <!-- and --> for inline-script safety - #4511

Fixes #4494.

When the inline-script feature is enabled (the default), esbuild escapes </script in string/template literals so output can be embedded in an inline <script> tag. The HTML parser's script data state machine also treats <!-- and --> specially:

• <!-- enters the "script data escaped" state
• a later <script in that state enters the "script data double escaped" state, where </script> no longer ends the element
• --> exits the escaped state

So a string like "<!-- <script>" defeats the existing </script escaping. This PR escapes <!-- as \x3c!-- and --> as --\x3e in string/template content, mirroring Terser's inline_script option, which the issue references:

console.log("<!--", "<script>", "-->");
// Becomes:
console.log("\x3c!--","<script>","--\x3e");

<script> (without a slash) is left alone, matching Terser: it is only dangerous after a <!--, which is now escaped, and in the normal script-data state <script does nothing special.

Tagged template literals such as String.raw\...`emit raw content verbatim, so the printer cannot escape them in place. The existing</scriptlowering (which turns such templates into__templatecalls) is extended to also cover, letting the same escapes apply to the raw content while preserving the runtime value (the \x3c/\x3eescapes are source-level only; the string value stays, same as the existing </script` handling).

Both the printer escaping and the tagged-template lowering are gated on compat.InlineScript being supported, consistent with the existing </script behavior.

// in
console.log("<!-- <script>", "-->");
// out
console.log("\x3c!-- <script>", "--\x3e");

// in
x = String.raw`<!--`;
// out
import { __template } from "<runtime>";
var _a;
x = String.raw(_a || (_a = __template(["\x3c!--"])));

go build ./... and go test ./... pass; gofmt and go vet clean on the touched files.