fix(settings): escape group names in the users admin group list

[DeepDiver1975]

Description

GroupList.addGroup() in settings/js/users/groups.js built each list item of the
users administration group list by concatenating the group id and the group name
into an HTML string, which jQuery then parses as markup. Both interpolated values
are now passed through the existing escapeHTML() helper (core/js/js.js), so the
values are rendered verbatim.

escapeHTML() covers both contexts the values appear in - the data-gid attribute
and the .groupname text node - and data-gid still round-trips as the literal
string, so getGroupLI() lookups keep matching.

Adds three regression tests to settings/tests/js/users/groupsSpec.js, which is
already wired into the settings karma suite.

Related Issue

n/a - no tracking issue.

Motivation and Context

Unlike usernames, group names are not restricted to an allow-listed character set:
Group\Manager::createGroup() only rejects empty and untrimmed names, and names
can also originate from an external backend such as LDAP. Group and quota values
in the user rows of the same panel (settings/js/users.js) already go through
escapeHTML(), so this makes the output encoding consistent across the users
administration panel.

The PHP template settings/templates/users/part.grouplist.php renders group names
with p() and was already correct - only the JS render path was affected.

How Has This Been Tested?

• test environment: local checkout, Node 22 + jsdom harness driving the real
  settings/js/users/groups.js with the repo's vendored jQuery and the real
  escapeHTML() extracted from core/js/js.js
• test case 1: group name containing <script> markup - renders as text, no
  <script> element in the row
• test case 2: group id containing an attribute breakout - no stray attribute is
  created and data-gid still reads back as the literal string
• test case 3: group name <img src=x onerror="..."> - no img element inside
  .groupname, name renders as text
• all three fail on the unpatched code and pass with the change; the pre-existing
  adds new user group spec still passes (4/4)
• note: karma is not installed in this environment, so the official
  make test-js runner was not executed locally - CI (js-unit.yml) covers it
• manual check: create a group named <img src=x onerror=alert(1)> in
  Settings -> Users; the name renders as literal text, both on creation and after
  a group-membership toggle (which re-renders via GroupList.update())

Screenshots (if appropriate):

n/a

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Database schema changes (next release will require increase of minor version instead of patch)
• Breaking change (fix or feature that would cause existing functionality to change)
• Technical debt
• Tests only (no source changes)

Checklist:

• Code changes
• Unit tests added
• Acceptance tests added
• Documentation ticket raised: n/a
• Changelog item, see TEMPLATE

[phil-davis]

Manually checked this, and it is fixed.
Previously, I could add a group named <b>Bold</b> and the group name was rendered as just the word "Bold" in bold type.
Now the group name renders exactly as the literal characters <b>Bold</b>