fix media track/caption XSS vulnerability, fixes CNVS-17659

ensure locale and other fields are properly sanitized when building
<track /> tags

test plan: see repro steps on CNVS-17659

Change-Id: I8016d05ce12854166ed467f06a2769c5f1bfa979
Reviewed-on: https://gerrit.instructure.com/46288
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: Caleb Guanzon <cguanzon@instructure.com>
Product-Review: Jon Jensen <jon@instructure.com>