Call escapeHtml on SQL statements when generating catalog report

It occurs to me that this statement text is not the only example of text that should be getting escaped.
Statement text was the culprit in the ticket driving the example, so MAYBE I am introducing SOME scope creep here, but we should try to cover all cases where we echo user ddl, especially where that ddl is likely to contain objectionable syntax -- I am thinking primarily of comparison operators as in the original repro case, but there may be other offenders?

To back-pedal a little on the scope creep, you can interpret "to cover" above as meaning "to either fix now OR to identify as still todo in a separate JIRA ticket".
So, the cases that come to mind (in my unbiased priority order) are:
    The raw ddl dump
    Matview definitions (mostly because of possible comparators in the filter clause)
    Soon, CREATE TABLE's LIMIT EXECUTE delete statement
    Index definitions
    In theory, any grammar element that allows a general expression could, as an edge case, use the CASE WHEN "?:"-style variant that has a logical subexpression.that could be a comparison.
    Also, I suppose that any quoted identifier could conceivably contain punctuation requiring escape, but there seem to be bigger fish to fry in supporting quoted identifiers.

Once we had the first two or three of these cases fixed, I would be tempted to lump the rest as having significantly lower priority.