Add escape-html function that escapes HTML special characters and apply
it in the comment editor at four dom/set-html! call sites where
user-provided text is inserted as innerHTML, preventing stored XSS.
References: GHSA-vc72-6r45-q988
Signed-off-by: Andrey Antukh <niwi@niwi.nz>
724f84df00