feat(popupdoc): Escape unsafe variables {title, tconfirm} in popupdoc() (refs #4914)

Automatically escaped by popupdoc():
- tconfirm
- title

Not automatically escaped (because can contain legitimate HTML):
- descr