fix: [security] XSS in the user homepage favourite button

- navigating to a url in MISP with the URL containing a javascript payload would cause the execution of reflected xss
- automatically sanitised by modern browsers, but still confirmed via raw curl fetches

app/View/Elements/global_menu.ctp

@@ -464,7 +464,7 @@
                     (!empty($homepage['path']) && $homepage['path'] === $this->here) ? 'orange' : '',
 		    __('Set the current page as your home page in MISP'),
 		    __('Set the current page as your home page in MISP'),
-                    $this->here
+                    h($this->here)
                 )
             ),
             array(