feat(tab): use .trustAsHtml (fixes #1004)