HTML escape user names when inserted into HTML.

[drgrice1]

The is done for the password change messages on the account settings page, the heading on the user detail page, the hardcopy confirmation for a single user on the hardcopy page, the missing merge data message on the email page, the scoring message on the Grades page, and the scoring file contents displayed on the scoring page.

For the grades page the variables in the scoring message are now replaced in a single pass, and each substituted value (user record fields and merge file columns) is HTML escaped. Previously each variable was replaced in a separate pass, so a value containing a variable (for example a first name of "$EMAIL") was itself expanded by a later pass, and values were inserted into the page unescaped.

Also, remove the stripping of special characters from the first and last names that come from LTI (for both LTI 1.1 and 1.3). That was done incorrectly (I accidentally used the e flag instead of the g flag on the regular expression substitution, and so only the first character was actually replaced.), and that is not needed with the other changes in this pull request.

[drgrice1]

Note that a somewhat botched approach at this was in #3100. This was also reported in another recent security scan for the grades page.