escape rendered npm package info

I noticed a template bug in `admin/plugins` - npm package info sometimes contains html tags, but it is unescaped before output.

This patch uses jQuery.text() instaed of jQuery.html() to output the npm values.

I didn't look through the codebase to see if there are other instances when remote data is rendered using html() - this is a potential attack vector, right?