Sanitize $limitReport before outputting

Prevents possible injection of "-->" and other HTML by extensions using
the ParserLimitReport hook.

bug: 46084
Change-Id: Id97b6668da6df3e5e4c0acefffa00c82cac3c44a