fix: escape unsafe key chars

[pi0]

Rich-Harris#19

[galvez]

Thanks for acting quickly on this @pi0

[JohannesLamberts]

@pi0 I tested using the https://codesandbox.io/s/5x2wpo27k4 and the fix looks good to me.

[JohannesLamberts]

I'd like to cross-reference vuejs/vuex-router-sync#89 and https://www.npmjs.com/advisories/814 here, which should also be fixed by this.

[pi0]

Something I'm not sure about this is that it may be also a breaking change. Objects like { "foo/bar": "baz" } can be broken. Maybe not something essentially bad as serialize-javascript also does the same.

UPDATE: Only / whitelisted. The case with reported sandboxes still will be prevented.