Search strings are output unescaped on the Zeitgeist report page

Problem/Motivation

The report page at admin/logs/zeitgeist (_zeitgeist_page()) outputs recorded search strings unescaped: they are passed to theme_table(), which prints cell contents verbatim.

Search strings are visitor input, recorded by zeitgeist_form_alter() whenever the search form is built, including for anonymous users with the search content permission. With the default "Upon display" validation setting, strings containing HTML are stored, and only the blocks filter them. So any visitor can inject markup that runs in the browser of an administrator viewing the report page.

Drupal 5 is unsupported, so this is handled in the public queue.

While fixing it, these related defects were found and fixed in the same change:

• The "Top searches" block ignored the "validate search strings" setting: only the "Latest searches" block applied it.
• Block titles ignored their settings: both blocks were titled "foo latest", and count placeholders were never replaced.
• The block configuration form named its title field title, which replaced core's block title override field, so core saved the module title as a literal override.

Steps to reproduce

1. Enable search and Zeitgeist, and grant search content to anonymous users.
2. As an anonymous user, visit search/node/<b>test</b>.
3. As an administrator, visit admin/logs/zeitgeist: "test" is rendered in bold, meaning the markup was output as HTML instead of text.

Proposed resolution

• Escape search strings with check_plain() in _zeitgeist_page(). The blocks already escape them through l().
• Apply _zeitgeist_validate() in the "Top searches" block, fetching an unlimited range so that rejected strings do not shrink the list.
• Build block titles from their settings, replacing @count (and the %count / !count forms saved by earlier releases) with the block's count, escaped on output.
• Rename the block configuration fields to zeitgeist_info and zeitgeist_title, so core's own title override works again.
• Documentation: remove CVS keywords, update URLs and install instructions.

Remaining tasks

• Review and commit to 5.x-1.x.
• Release 5.x-1.1.
• Follow-up: 6.x and 7.x have the same unescaped output in the multicolumn report (ReportMulticolumn), reachable with the access site reports permission.

User interface changes

Block titles now follow their configured value. Sites that saved a block configuration with an earlier release may need to empty the core "Block title" field once: see INSTALL.txt, "Upgrading".

API changes

None.

Data model changes

None. No update function: existing {blocks}.title values are left for administrators to review.

AI disclosure

Fix developed with Claude Opus 5.5.