[SECURITY] XSS in header link of all content elements

The second typolink parameter, that is the target, can be abused to
introduce XSS code into the generated link. Escaping the parameter
with quoteJSvalue solves the problem.

Change-Id: I1652e2f1e9fea660d2a5a9e74ace6317fe05ba3b
Fixes: #31206
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 4a1a06ad0124defafb991639b19d81f81f7d5b95
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26184
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader