Html escaped from display name in xblock.

LMS-11194

You can set the Display Name on any xblock, and it will render the raw text, not escaped. This allows any HTML tags, including script injection.