Fix xss

[kevinpapst]

Description

Fixing multiple possible XSS attacks in the backend.

This was (in a default setup) not possible to be executed by normal users, but only accounts with elevated permissions.
The users had to have permissions to edit activities/projects/customers.

Thanks to SektionEins who reported the problem in a secure manner and allowed me to publish a new Kimai version before making the information public.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist

• I verified that my code applies to the guidelines (composer code-check)
• I updated the documentation (see here)
• I agree that this code is used in Kimai and will be published under the MIT license

[codecov]

Codecov Report

Merging #2060 into master will increase coverage by 0.00%.
The diff coverage is 100.00%.

@@            Coverage Diff            @@
##             master    #2060   +/-   ##
=========================================
  Coverage     93.27%   93.28%           
- Complexity     5790     5792    +2     
=========================================
  Files           530      530           
  Lines         17542    17547    +5     
=========================================
+ Hits          16363    16368    +5     
  Misses         1179     1179           

Impacted Files	Coverage Δ	Complexity Δ
src/Twig/Extensions.php	100.00% <100.00%> (ø)	20.00 <2.00> (+2.00)
src/Twig/MarkdownExtension.php	100.00% <100.00%> (ø)	14.00 <0.00> (ø)