Prevent XSS via $_GET param for controller action

Originally fixed in 2.2.x via https://github.com/modxcms/revolution/commit/77463eb6a8090f474b04fdc1b72225cb93c558ea - was reverted somehow

Should address #11966