Sanitize $limitReport before outputting

Prevents possible injection of "-->" and other HTML by extensions using
the ParserLimitReport hook.

(cherry-picked from 69f96f65dd99e54b84e489e7d957b7526653474c)

Bug: 46084
Change-Id: Id97b6668da6df3e5e4c0acefffa00c82cac3c44a
Merge "Sanitize $limitReport before outputting" into REL1_20