Meets #7505: HTML/scripts are not escaped when renaming cost reports

[``* `#7505` HTML/scripts are not escaped when renaming cost reports``](https://www.openproject.org/work_packages/7505)