[Bug]: Avatar hover description in Files shows "&" instead of "&"

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

when hovered the avatar picture of the owner of a shared folder shows & if the Displayname (not username) contains an "&".

Steps to reproduce

1. create user "bits & trees"
2. share a folder
3. hover the avatar of the shared folder with the mouse

Expected behavior

show "bits & trees" not "bits & trees"

Nextcloud Server version

29

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.2

Web server

Apache (supported)

Database engine version

None

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response

No source file, test, or entry point is named. Reproduce the issue in Files by creating a user named "bits & trees", sharing a folder, and hovering the owner's avatar; trace the display-name rendering and verify that the hover description shows "bits & trees" rather than "bits & trees".