translate: Add missing escaping to language name

Fixes https://hackerone.com/reports/1486674

weblate/trans/forms.py

@@ -37,6 +37,7 @@
 from django.template.loader import render_to_string
 from django.urls import reverse
 from django.utils import timezone
+from django.utils.html import escape
 from django.utils.http import urlencode
 from django.utils.safestring import mark_safe
 from django.utils.translation import gettext
@@ -318,7 +319,7 @@ def render(self, name, value, attrs=None, renderer=None, **kwargs):
             # Render textare
             textarea = super().render(fieldname, val, attrs, renderer, **kwargs)
             # Label for plural
-            label = str(unit.translation.language)
+            label = escape(unit.translation.language)
             if len(values) != 1:
                 label = f"{label}, {plural.get_plural_label(idx)}"
             ret.append(