src/webapp/forms.php: Properly escape both the 'value' attribute and 'label' (content of <option> element) when rendering SelectField.