Test spanRowFormatter, and mark the gosec issue as a false-positive

[dmathieu]

Closes #4451

As mentioned in the other issue, I am not doing any escaping here.

• The HTML tags we already have there need not to be escaped, so they will be properly rendered in zpages.
• The Trace ID and Span ID are hexadecimal byte arrays. We decode them using encoding/hex, which can only output [0-9a-f], not any character that HTML should encode.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 61.7%. Comparing base (3ca855b) to head (13b81ae).

Additional details and impacted files

@@          Coverage Diff          @@
##            main   #5327   +/-   ##
=====================================
  Coverage   61.6%   61.7%           
=====================================
  Files        186     186           
  Lines      11382   11388    +6     
=====================================
+ Hits        7021    7032   +11     
+ Misses      4160    4153    -7     
- Partials     201     203    +2     

Files	Coverage Δ
zpages/templates.go	64.2% <100.0%> (+41.5%)	⬆️

... and 1 file with indirect coverage changes