[PR] Add escaping of output for HTML when pulled from the database

* Wraps output from the database intended as HTML with `esc_html()`
* Wraps output from the database intended for use as an attribute with `esc_attr()`
* Enqueues `brand.js` in the footer as it is not required until document ready.