fix: escape HTML output in scan result views (stored XSS)

[TrueFurina]

Summary

Stored XSS (fix #2012): OSINT-collected data is rendered into innerHTML
without escaping across all scan result views in scaninfo.tmpl:

• browseEventData() event table — data[i][1]/data[i][2] via
  sf.replace_sfurltag(), plus data[i][0]/data[i][3]/data[i][8]
• viewScanLog() — data[i][0..3] (log lines can contain collected data)
• browseEventList() — data[i][1] as link text
• browseCorrelations()/toggleCorrelation() — correlation titles,
  tooltips, event data
• unique-view (browseEventData unique mode) — data[i][0]/data[i][2]

sf.replace_sfurltag() only converts <sfurl> markers; it does not escape
HTML, so <script>/<img onerror=...> collected from a scanned target
execute in the SpiderFoot web UI context.

Fix

• Add sf.escapeHtml() (escapes & < > " ') to
  spiderfoot/static/js/spiderfoot.js.
• Wrap every OSINT-data concatenation point in scaninfo.tmpl (23 calls)
  with sf.escapeHtml(...); where sfurl links are intended, apply escape
  first, then sf.replace_sfurltag(...) so links still render (the
  escaped <sfurl> marker is handled by its existing first branch).
• Intentionally untouched (not OSINT-rendered): numeric id attributes
  (id='cb_...', corrwell_tr_...) and the escape()-encoded value inside
  the onClick string in browseEventList.

Verification

• node --check spiderfoot/static/js/spiderfoot.js → OK
• Behavior test running payloads through the exact rendering path:
  <script>alert(1)</script>, "><img src=x onerror=alert(1)>,
  ';alert(1);//, <b>bold</b>, normal & "quotes" → all escaped;
  <sfurl>https://evil.example/p?a=1&b=2</sfurl> → still renders as a link
• grep audit: no bare data[i] concatenation remains in scaninfo.tmpl
  (only numeric id/attribute usages)

Files changed

• spiderfoot/static/js/spiderfoot.js (+8: sf.escapeHtml)
• spiderfoot/templates/scaninfo.tmpl (all OSINT-data render points escaped)

Fixes #2012