emergency HTML/JS injection fix.

found when looking at #6193, sanitation of status display input was missing everywhere.
unless i made a mistake this should be merged ASAP, even if it breaks a feature,
which can be fixed later.
tested it on master, admins will be injected with malicious code when log-notified and when viewing VVs,
head players and anybody with the cartridge-access will be injected when viewing their PDAs,
any player will be injected when examining the display.