fix speedgrader xss vulnerability

closes CNVS-13427

test plan:
- create a course with multiple sections, and name one of them with html in the
  name
- also create multiple teachers and name them with html in the name
- create an assignment with a rubric
- go to speedgrader
- in the student dropdown menu, where you can pick which section to filter, the
  section name should be escaped (should show the raw html)
- fill out the rubric with multiple teachers
- reload speedgrader, there should be a dropdown that lets you pick which
  rubric assessment to look at it, and in that dropdown, the teacher name with
  html should be escaped

Change-Id: I2521e2fb4130cc97d47fa233a0fdc105302e9874
Reviewed-on: https://gerrit.instructure.com/35983
Reviewed-by: Tyler Pickett <tpickett+gerrit@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Amber Taniuchi <amber@instructure.com>
Product-Review: Simon Williams <simon@instructure.com>
treesame commit of origin/stable/2014-05-24

Treesame-Commit-Id: a62bd4725084e58ac50d6e63e4b9a3eb20eecff8