Bug 1067383 - escape html in commit messages

I'm always wary on home-grown sanitisation, since it's easy to miss edge cases that people can take advantage of (eg see some of the guides on https://www.owasp.org/index.php/Main_Page).