Escape branch name in dropdown menu

[jonasfranz]

Fix XSS part of #3681 by removing safe from BranchName in the dropdown menu.

Requires backport to 1.4.

[codecov-io]

Codecov Report

Merging #3691 into master will decrease coverage by 0.01%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master    #3691      +/-   ##
==========================================
- Coverage    35.8%   35.79%   -0.02%     
==========================================
  Files         287      287              
  Lines       41489    41489              
==========================================
- Hits        14857    14852       -5     
- Misses      24445    24450       +5     
  Partials     2187     2187

Impacted Files	Coverage Δ
modules/process/manager.go	76.81% <0%> (-4.35%)	⬇️
models/repo_list.go	56.37% <0%> (-1.35%)	⬇️
models/repo_indexer.go	48.3% <0%> (ø)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c28bf94...61ce616. Read the comment docs.

[lafriks]

It would been better to use escape just for branch name