Format error messages as text to avoid XSS vulnerabilities

[artwyman]

Mark error messages from api.zupass.org as text to ensure any <script> tags in them are not executed. Those could come directly from user input.

This was reported by Andrew (a different one, not me) at Devcon. The risk here is low since api.zupass.org is a different domain with no sensitive data in cookies or local storage, but still good to clean up the risk that users could be tricked into something dangerous.

Two test URLs which demonstrate script injection via URL parameters on api.zupass.org:

https://api-staging.zupass.org/sync/v3/load?blobKey=%3Cscript%3Ealert(%22andrewwashere%22)%3C%2fscript%3E

https://api.zupass.org/generic-issuance/api/feed/19ffc405-742f-4485-a831-2ea7e987666d/zu-thailand%3Cscript%3Ealert(%60Cookies%3A%20%24%7Bdocument.cookie%7D%2C%20LocalStorage%3A%20%24%7BJSON.stringify(localStorage)%7D%60)%3C%2Fscript%3E

Here are versions of those URLs which demonstrate the issue on my local test server:

http://localhost:3002/sync/v3/load?blobKey=%3Cscript%3Ealert(%22andrewwashere%22)%3C%2fscript%3E

http://localhost:3002/generic-issuance/api/feed/d16ddd24-0155-4244-8799-80f2c4afdc5f/0%3Cscript%3Ealert(%60Cookies%3A%20%24%7Bdocument.cookie%7D%2C%20LocalStorage%3A%20%24%7BJSON.stringify(localStorage)%7D%60)%3C%2Fscript%3E

Attn: @antimatter15 who submitted an initial version of this in #2159 .