Escape HTML in the logged out display message

Problem/Motivation

The Session Limit module currently renders the configured “Logged out display message” as markup when it is displayed to users who are logged out due to session limits.

Since this message is configurable through the admin UI, it would be safer to escape it and treat it as plain text instead of interpreting it as HTML.

Steps to reproduce

1. Enable the Session Limit module.
2. Go to: /admin/config/people/session-limit
3. Set “Default maximum number of active sessions” to 1.
4. Set behaviour to: “Automatically drop the oldest sessions”.
5. In the “Logged out display message” field, enter text that contains HTML tags.
6. Trigger a session limit logout event.
7. Observe that the configured text is rendered as HTML.

Actual behaviour
Observe that the configured text is rendered as HTML.

Expected behaviour
The configured message should be safely escaped and displayed as plain text.

Notes
The configuration page is protected by the restricted `administer site configuration` permission. Therefore, the Drupal Security Team has approved this issue for public handling.

Tested on
- Drupal 11.2.10
- Session Limit 2.0.2
- With the Drupal 11 compatibility patch applied from: https://www.drupal.org/project/session_limit/issues/3454543

Proposed resolution

Escape the configured “Logged out display message” before rendering so it is always treated as plain text and not interpreted as HTML.

Remaining tasks

User interface changes

API changes

Data model changes