Fix XSS Vulnerability In "tpl.inc.php"

`/include/staff/tpl.inc.php` fetches `$_REQUEST['code_name']` on [L10](https://github.com/osTicket/osTicket-1.8/blob/develop/include/staff/tpl.inc.php#L10), and puts it into the `$extras` array on [L12](https://github.com/osTicket/osTicket-1.8/blob/develop/include/staff/tpl.inc.php#L12). This array is then looped through as key/value pairs to create form fields on [L79-L81](https://github.com/osTicket/osTicket-1.8/blob/develop/include/staff/tpl.inc.php#L79-L81). The value is never sanitized.

**POC:** *(tested and works)*
```
/scp/templates.php?tpl_id=1&a=implement&code_name="><script>alert(1)</script><
```
Fix applied to where the value is directly output to browser instead of where fetched in case special chars are allowed in `code_name`, which may break logic prior to output. Also best practice.