LPS-46569, LPS-49216, LPS-49215, LPS-49220

We can't use one of the normal escapes methods here because <aui:a> already escapes the href attribute, so escaping it again here will result in a double escape.

Also, we can't fix in `<aui:a>` because `href="javascript:doSomething()"` type links are allowed.