Replies without formatting aren't html esaped

Replies without formatting, e.g. when replying `<.<` to a message, doesn't get html escaped in the `formatted_body`. This leads to many clients, such as riot-web, not rendering the message at all.

Trace the reply handling that produces formatted_body, using the unformatted reply example '<.<' as the reproduction case. Check how the resulting message is consumed by clients such as riot-web, then verify that the formatted_body is HTML-escaped and that the message renders correctly.

Written by the indexing model from the issue text.