We need to make sure we are encoding all data shown on a package details page and the packages list to ensure it's impossible for a package to cause us to render their HTML.

I'm pretty sure we've already verified that thoroughly, but it's a good time to double-check all places where we're rendering user input from a package's metadata.