Search Optgroups

@kenearley @stof @koenpunt

Exactly what it says on the label: this adds optgroups to the search mechanism. When a group matches, all of its child options are shown regardless of their match status.

This also brings in escaping for optgroup labels. There's a long outstanding XSS vulnerability that needs closing.