Properly sanitize user-defined dropzone message

Dropzone area message is not rendered through the Twig, which means that it is not automatically sanitized. I tried to exploit it, but it seems that any Javascript code injected into it won't fire.

I think that we should escape the text nonetheless.

Problem is mitigated by the fact that one needs administrative permission to potentially exploit it.