CSRF in Matomo Settings Form

Problem/Motivation

This module does not escape a label in the Matomo admin settings form.

Steps to reproduce

You can see this vulnerability by:

1. Enabling the module
2. As a user with "administer permissions" permission, create or edit an existing role with HTML in name. For example <img src="csrf">.
3. As a user with "administer matomo" permission access /admin/config/system/matomo, open tab "Roles" and check the role with label containing HTML.
4. HTML is inserted unescaped into the vertical tab summary.
   

Proposed resolution

When the label is created via PHP, HTML::escape is used to escape special characters. The code looks like this:
<label for="edit-matomo-visibility-user-role-roles-4" class="form-item__label option">&lt;img src=&quot;csrf&quot;&gt;</label>
When the label is checked and the summary is updated via JavaScript, the label is considered text, HTML entities are decoded and then written to the tab summary. A solution could be treating the role labels as HTML.