cleosrv: Automatically ensure all textual input is HTML escaped to prevent XSS

It's already the case for forecast creation, but it's easy to forget when adding new operations. Ideally it should be the default for any textual input. In a later increment it might be desirable to allow for some safe HTML so people can style e.g. the forecast description. Alternatively supporting markdown would be great.

Start in cleosrv by locating the existing HTML escaping used for forecast creation and tracing how other textual inputs enter the application. Define the default escaping behavior for every textual input, then verify that user-provided text cannot produce executable HTML or script content; the issue also leaves safe HTML and Markdown as unresolved alternatives.

Written by the indexing model from the issue text.