SECURITY: Escape username in invalid username error

POST request with invalid usernames to SpecialScratchOAuth2 page in 
ScratchOAuth2 may lead to reflected cross-site scripting.

includes/special/SpecialScratchOAuth2.php

@@ -69,7 +69,7 @@ public function specialLogin( $error = null ) {
 			$username = $request->getVal( 'username', '', );
 			if (!preg_match(SOA2_USERNAME_REGEX, $username)) {
 				$this->specialLogin(
-					wfMessage('soa2-invalid-username', $username)->plain()
+					wfMessage('soa2-invalid-username')->plaintextParams($username)->parse()
 				);
 				return;
 			}