Bug 1067383 - escape html in commit messages

I think $sanitize might do this work for us, doesn't it?  https://docs.angularjs.org/api/ngSanitize/service/$sanitize

Looks like the ``ng-bind`` escapes the HTML and shows it.  Whereas ``ng-bind-html`` will show the HTML styled, but without links or anything.  ``ng-bind`` is probably right here?