[SECURITY] XSS in header link of all content elements

The second typolink parameter, that is the target, can be abused to
introduce XSS code into the generated link. Escaping the parameter
with quoteJSvalue solves the problem.a

Change-Id: I9bea9114437852cdb8e0586d4e867cdf7a5a1138
Fixes: #31206
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: b9b7d0ba0979fe9c2ac8af5df944cf09d187b60d
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26205
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader