gitweb: escape link body in format_ref_marker

gitweb: escape link body in format_ref_marker

Fix a case where an html link can be generated from unescaped input
resulting in invalid strict xhtml or potentially injected code.

An overview of a repo with a tag "1.0.0&0.0.1" would previously result
in an unescaped ampersand in the link body.

Signed-off-by: Andreas Brauchli <redacted>
Acked-by: Jakub Narębski <redacted>
Signed-off-by: Junio C Hamano <redacted>