Update tags.js

add an insecure html scrubber that replaces carrots with html codes so that raw html entries don't XSS the page simply, anymore. r=potch