fix(security): escape the project name in the analytic modal title

LayoutHelper::analytic() prefixes the title with the raw project name, and
the AJAX branch of analytic/layout.php printed that title as is, so a
project name containing markup was injected into the analytic modals.

Escape it with $this->text->e() like the other layouts do. It does not
double-encode, so the ">" separator still renders as ">".

app/Template/analytic/layout.php

@@ -1,6 +1,6 @@
 <?php if ($is_ajax): ?>
     <div class="page-header">
-        <h2><?= $title ?></h2>
+        <h2><?= $this->text->e($title) ?></h2>
     </div>
 <?php else: ?>
     <?= $this->projectHeader->render($project, 'TaskListController', 'show') ?>

tests/units/Core/TemplateTest.php

@@ -3,6 +3,7 @@
 namespace KanboardTests\units\Core;
 
 use KanboardTests\units\Base;
+use Kanboard\Core\Http\Request;
 use Kanboard\Core\Security\Role;
 use Kanboard\Core\Template;
 
@@ -82,4 +83,26 @@ class TemplateTest extends Base
             $html
         );
     }
+
+    public function testAnalyticAjaxLayoutEscapesProjectNameInTitle()
+    {
+        $this->container['request'] = new Request($this->container, array(
+            'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest',
+        ));
+
+        $html = $this->container['helper']->layout->analytic('analytic/task_distribution', array(
+            'project' => array('id' => 1, 'name' => '<img src=x onerror=alert(document.domain)>'),
+            'metrics' => array(),
+            'title' => 'Task distribution',
+        ));
+
+        $this->assertStringNotContainsString(
+            '<img src=x onerror=alert(document.domain)>',
+            $html
+        );
+        $this->assertStringContainsString(
+            '<h2>&lt;img src=x onerror=alert(document.domain)&gt; &gt; Task distribution</h2>',
+            $html
+        );
+    }
 }