XSS vulnerabilities in Relation Dummy field.

Problem/Motivation

The Relation dummy field module/formatter has 2 XSS issues, one on relation type (reverse) label (less critical, given the permissions required to create relation types, and since only the natural language formatter is vulnerable), and one on entity title/subject (more critical, given that less stringent permissions usually apply to editing/creating entities, and since all dummy field formatters are vulnerable.)

Proposed resolution

Properly escape entity titles when entities are displayed as subjects, and make sure relationship labels are sanitized prior to output.

Remaining tasks

Verify attached patch and test.

User interface changes

Text that was outputted unescaped prior to this patch will now be properly escaped.

API changes

None.

Data model changes

None.