fix xss issues #1685

[daniel-wer]

This PR fixes the XSS vectors I've found during my recent webknossos security review. See https://docs.google.com/presentation/d/1zTBnoy3_lTsoBfMeOz96W3bnlUtvTv2qkXrKMiu326s/edit?usp=sharing

I've also replaced all unnecessary uses of <%= in Backbone (Lodash) templates with <%- (that html encodes strings).

Steps to test:

• XSS Vector 1

  • Sign up with a user with the name <script>alert('xss')</script>, login as another user and go to the overview page, select the team of the malicious user (and adjust the hours slider, so the user is displayed)
  • You should not see an alert when hovering over the malicious user and the popover should have linebreaks

• XSS Vector 2

  • Create a team with the name <script>alert('xss')</script> and create a project belonging to the newly created team.
  • You should not see an alert when looking at the projects list, but instead the team name should be displayed in the table (safely escaped)

Issues:

• part of Enhance webknossos security #1685

ATTENTION: Merging this PR may close #1685 as my commit message unfortunately contains the word fix :/ If so, please reopen the issue as it contains more ToDos.

---

• Ready for review

[hotzenklotz]

LGTM