Filename: Using text instead of HTML to avoid exploitable

When setting the file name returned by the browser using
jQuery's .html() method, every kind of crap can be injected into the
HTML DOM. Consider a user downloaded a file with an evil file name and
is uploading this using UploadWizard, for example. On Windows, this
might not be an issue, but on Linux it is.

However, when using .text(), the node's innerText attribute is set and
nothing bad can be injected in the HTML DOM.

Bug: 51801
Change-Id: I71f0c458d340a96b4b39e2bb2de98d23724cd473