Call escapeHtml on SQL statements when generating catalog report

Well... you're right this wasn't the exact example.  The example had a predicate like `f<?`. Somehow Chrome interprets `<?` as the beginning of a comment `<!-- ... -->`, which was swallowing up all of the rendered text up to the next `>`.  

If you use "inspect element" in Chrome, it actually shows a well-formed HTML comment containing the end of the query, even though the HTML we generate doesn't have a comment there.  Chrome must have a pre-pass where it "fixes" the HTML that looks broken.

I verified this fix with the catalog.jar provided with the bug.  I can also update the test to actually test the `<?` combination.