fix content migration XSS vulnerability, closes #CNVS-17655

prevent malicious LTI apps from XSSing users who use them to import course
content

test plan:
1. refer to repro steps on CNVS-17655

Change-Id: Ib327432722b404f9f0ea4c3f15552eea309bc3eb
Reviewed-on: https://gerrit.instructure.com/46280
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Bracken Mosbacker <bracken@instructure.com>
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
QA-Review: Caleb Guanzon <cguanzon@instructure.com>