BibFormat: fix for XSS vulnerability in `ln`

* Fixes XSS vulnerability in language parameter for queries such as
  </search?ln=en296b9%22%3E%3Cscript%3Ealert%281%29%3C/script%3Ee2d>.

Reported-by: Pietari Hyvärinen <pietari.hyvarinen@csc.fi>
Signed-off-by: Tibor Simko <tibor.simko@cern.ch>