escape possibly attackable version string

The version string read from the davical.org webserver might be changed by an
attacker (XSS).
Even though this is highly unlikley (there are only 12 characters read) it's
better to HTML escape any such string that is printed to HTML.

This was originally reported at:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=703290