Well I guess this is out of the scope of this PR. Should the supplied URL contain HTML escapes? I'd argue not. 

The outputted URL doesn't appear to be escaped when going out to the template. Look at [test case #3](https://github.com/phpbb/phpbb3/blob/develop/tests/template/templates/includejs.html#L6) ([expected](https://github.com/phpbb/phpbb3/blob/develop/tests/template/template_includejs_test.php#L33)) there is no HTML escaping of the URL before it goes out to the template.

/cc @EXreaction