Call escapeHtml on SQL statements when generating catalog report

You're right that this fix just addresses the bug and not the larger issue of escaping HTML entities in the report in general.  I was thinking the only other offender here was quoted identifiers, but as you point out there's other ways to run afoul of HTML standards.

It seems like the HTML entities that we need to be concerned with are:
```HTML
&amp; (ampersand)
&quot; (double quote)
&lt; 
&gt;
```
For example, the warnings list on the overview page contains double quotes that we should be escaping.  In general, it seems like we can't go wrong by escaping any text that we want rendered by the browser.

I'll push another commit that escapes at least the DDL, and look at handling quoted identifiers, since that doesn't seem too hard.