Bug 37655: Basic editor needs to HTML-escape the bib record title used as a heading

We stick the title of a bib record you are editing in the basic editor into
an <h1> without escaping any HTML it might contain. We should instead escape
it.

Test plan:

1. Without the patch, search for any record in the catalog and click Edit
   record (if you are in the advanced editor, switch to the basic one)
2. Tab 2, Field 245, Subfield a, paste <script>alert('boo ❤')</script><h2>
   at the end of the subfield
3. Save, then from the record detail page select Edit - Edit record
4. You will have gotten an alert(), and the entire form will be the size
   of an <h2>. That's ugly, so go back to the detail page.
5. Apply patch, restart_all
6. Edit - Edit record
7. Now you should not get an alert, the whole title inluding the <script>
   should display in italics, and the "(Record number nnn)" after it should
   not be italicized.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>

koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt

@@ -838,7 +838,7 @@ $(document).ready(function(){
 
                 <h1>
                     [% IF ( biblionumber ) %]
-                        Editing [% title | $HtmlTags tag="em" %] (Record number [% biblionumber | html %])
+                        Editing [% title | html | $HtmlTags tag="em" %] (Record number [% biblionumber | html %])
                     [% ELSE %]
                         [% IF (circborrowernumber) %]
                             <span>Add MARC record (fast cataloging)</span>