fix: escapeTag correctly works with booleans

[DamianCSpendesk]

In relation to #538, the issue boils down to the code in escapeTag, where we call

xmlEscape(text || "")

This fails for "falsey" values, in our case for AllowCreate being false. Even passing true, we end up with an error as the xml-escape lib used actually expects a string.

This PR tests for undefined and null, where it'll pass an empty string. For all other values, it will convert to a string. As a result, our AllowCreate gets correctly set

...
<samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" AllowCreate="false"/></samlp:AuthnRequest>

[DamianCSpendesk]

@tngan Sorry for the ping - for whatever reason, I can't add you as a reviewer

[adrai]

@tngan can this be merged?