Attribute names in HTML-format branch not passed through stringify()

As discussed via security report, pug-attrs/index.js line 78 concatenates attribute names directly into generated JavaScript without calling stringify(), while the object-format branch at line 91 correctly uses stringify(key).

This is a hardening improvement, not a security vulnerability (template source is trusted input by design).

Suggested fix at line 78:

// Before:
buf += key + '=';
// After:
buf += stringify(key) + '=';

This ensures consistent escaping between both code branches.