feat(popupdoc): Escape unsafe variables {title, tconfirm} in popupdoc() (refs #4914)

Automatically escaped by popupdoc():
- tconfirm
- title

Not automatically escaped (because can contain legitimate HTML):
- descr
Merge pull request #1259 from eguaj/3.2-A4914

feat(popupdoc): Escape unsafe variables {title, tconfirm} in popupdoc() (closes #4914)