Describe the bug
When an enclosure URL contains an unescaped & character, the generated RSS or Atom feed becomes invalid XML.
For example, this output:

<enclosure url="https://example.com/hello&world.png" />

s not well-formed XML because & must be escaped as &.
This causes some feed readers or validators to fail when parsing the feed.

To Reproduce
Steps to reproduce the behavior:

1. Create a feed item with an enclosure whose URL includes an & in its query string.
2. Generate the feed.
3. Open the XML in a validator or RSS reader.
4. Observe that parsing fails due to invalid XML syntax.

Expected behavior
The feed generator should escape unsafe characters in URLs, producing well-formed XML.
For example:

<enclosure url="https://example.com/hello&amp;world.png" />

Actual behavior
The generated XML includes the raw & character in the enclosure URL, resulting in invalid XML output.

Versions (please complete the following information):

• feed: 5.1.0

Additional context
I plan to submit a pull request to fix this issue.