Fix XSS in select2 fields

Use select2's escapeMarkup function for our own formatter implementation.