fix(security): escape the project name in the analytic modal title

LayoutHelper::analytic() prefixes the title with the raw project name, and
the AJAX branch of analytic/layout.php printed that title as is, so a
project name containing markup was injected into the analytic modals.

Escape it with $this->text->e() like the other layouts do. It does not
double-encode, so the ">" separator still renders as ">".

app/Template/analytic/layout.php

@@ -1,6 +1,6 @@
 <?php if ($is_ajax): ?>
     <div class="page-header">
-        <h2><?= $title ?></h2>
+        <h2><?= $this->text->e($title) ?></h2>
     </div>
 <?php else: ?>
     <?= $this->projectHeader->render($project, 'TaskListController', 'show') ?>