Fix XSS when using setFormatValue($callable)

[allan-simon]

instead if people do need it we force them do to

->setStripTag(true) before

Example to reproduce create two entities Comment and Author in the Comment crud controller do the following

        yield AssociationField::new('author', 'Author of the comment')
            ->formatValue(function ($value, Author $author) {
                 return $author->getName();
            });

if the author's name contains <script>alert("coucou")</script> it will inject a XSS in the admin

instead with this PR you will be required to do

        yield AssociationField::new('author', 'Author of the comment')
           ->stripTag(false)
            ->formatValue(function ($value, Author $author) {
                 return $author->getName();
            });

if you want to intentionnaly disable it

[allan-simon]

here I really think it's a bug , because TextField::setFormatValue is safe by default , while associationField::setFormatValue is not

[allan-simon]

@javiereguiluz do you agree with me here (so that I know if it's worth it to fix the PR )