Python-style listing does not escape the request path, and -py with -sandbox panics #211

simplehttpserver version:

dev

Current Behavior:

• With -py, the directory listing writes the request path into the HTML page without escaping, so characters such as < and " in the path change the page.
• Running with -py and -sandbox together panics on the first request.

Expected Behavior:

• The path is HTML-escaped in the listing.
• -py with -sandbox returns a clear error at startup.

Steps To Reproduce:

1. Run simplehttpserver -py and open a directory URL with special characters in the path.
2. Run simplehttpserver -py -sandbox and send any request.

Anything else: