[ruby/roda-sequel] Use CGI.escape_html (#10097)
Roda will use the faster `CGI.escape_html` if the "cgi" gem is
installed:
https://github.com/jeremyevans/roda/blob/d89cd5d7310dad20eb706eb392ebbce49f815e67/lib/roda/plugins/h.rb
```ruby
require 'benchmark/ips'
require 'erb'
Benchmark.ips do |x|
x.config(time: 5)
messages = []
messages << 'Additional fortune added at request time.'
messages << 'フレームワークのベンチマーク'
messages << '<script>alert("This should not be displayed in a browser alert box.");</script>'
require 'cgi'
x.report("CGI") do
messages.each do |m|
CGI.escape_html(m)
end
end
ESCAPE_HTML = {
"&" => "&".freeze,
"<" => "<".freeze,
">" => ">".freeze,
"'" => "'".freeze,
'"' => """.freeze,
}.freeze
# A Regexp of HTML entities to match for escaping.
ESCAPE_HTML_PATTERN = Regexp.union(*ESCAPE_HTML.keys)
x.report("ESCAPE_HTML") do
messages.each do |m|
m.to_s.gsub(ESCAPE_HTML_PATTERN){|c| ESCAPE_HTML[c] }
end
end
x.compare!
end
```
```
ruby 3.4.5 (2025-07-16 revision 20cda200d3) +PRISM [arm64-darwin24]
Warming up --------------------------------------
CGI 39.444k i/100ms
ESCAPE_HTML 33.482k i/100ms
Calculating -------------------------------------
CGI 394.120k (± 1.0%) i/s (2.54 μs/i) - 1.972M in 5.004594s
ESCAPE_HTML 333.558k (± 1.6%) i/s (3.00 μs/i) - 1.674M in 5.020278s
Comparison:
CGI: 394120.5 i/s
ESCAPE_HTML: 333557.6 i/s - 1.18x slower
```
Petrik de Heus