GEOS-5318: fix xss vulnerability in OpenLayersMapOutputFormat (backport to 2.5.x)