Fix an XSS vulnerability in the search results.
Fix an XSS vulnerability in the search results.

Users with full names containing HTML would result in that HTML being
processed by the browser when auto-completing them in the Search field
at the top of any page. This could result in a script in the First or
Last Name fields being executed.

This change fixes the formatItem call to properly escape.

This vulnerability was made public by the reporter both publicly on the
issue tracker (+ mailing list), and on reviews.reviewboard.org. We're
going to cut a new release including this fix quickly as a result.

chipx86/reviewboard,beol/reviewboard,KnowNo/reviewboard,bkochendorfer/reviewboard,sgallagher/reviewboard,bkochendorfer/reviewboard,davidt/reviewboard,beol/reviewboard,beol/reviewboard,beol/reviewboard,davidt/reviewboard,sgallagher/reviewboard,reviewboard/reviewboard,1tush/reviewboard,KnowNo/reviewboard,reviewboard/reviewboard,1tush/reviewboard,reviewboard/reviewboard,1tush/reviewboard,KnowNo/reviewboard,chipx86/reviewboard,1tush/reviewboard,brennie/reviewboard,1tush/reviewboard,custode/reviewboard,1tush/reviewboard,bkochendorfer/reviewboard,custode/reviewboard,davidt/reviewboard,1tush/reviewboard,KnowNo/reviewboard,davidt/reviewboard,brennie/reviewboard,chipx86/reviewboard,custode/reviewboard,1tush/reviewboard,sgallagher/reviewboard,custode/reviewboard,brennie/reviewboard,bkochendorfer/reviewboard,reviewboard/reviewboard,chipx86/reviewboard,1tush/reviewboard,sgallagher/reviewboard,brennie/reviewboard