Escape user data in server-data.rst

Escape user data for HTML attributes to prevent XSS.

This is already done in the second code snippet below.

Author: dave1010

frontend/server-data.rst

@@ -10,7 +10,7 @@ them later in JavaScript. For example:
 
     <div class="js-user-rating"
         data-is-authenticated="{{ app.user ? 'true' : 'false' }}"
-        data-user="{{ app.user|serialize(format = 'json') }}"
+        data-user="{{ app.user|serialize(format = 'json')|e('html_attr') }}"
     >
         <!-- ... -->
     </div>