Port form_select_options() XSS fix from SA-CORE-2014-003

See https://www.drupal.org/SA-CORE-2014-003

Patch from D7:

diff --git a/includes/form.inc b/includes/form.inc
index 846bcb5..3840885 100644
--- a/includes/form.inc
+++ b/includes/form.inc
@@ -2722,7 +2722,7 @@ function form_select_options($element, $choices = NULL) {
   $options = '';
   foreach ($choices as $key => $choice) {
     if (is_array($choice)) {
-      $options .= '<optgroup label="' . $key . '">';
+      $options .= '<optgroup label="' . check_plain($key) . '">';
       $options .= form_select_options($element, $choice);
       $options .= '</optgroup>';
     }