rustdoc: escape shown input to prevent injection

See #13884 for the details. Closes #13884.

r? @alexcrichton