[Stable][Fix] 7505 html scripts are not escaped

[``* `#7505` HTML/scripts are not escaped when renaming cost reports``](https://www.openproject.org/work_packages/7505)