Meets #7505: HTML/scripts are not escaped when renaming cost reports

* `#7505` HTML/scripts are not escaped when renaming cost reports