The HTML report writes test titles into the markup unescaped

[Chemaclass]

Problem

src/reports/html.sh has no escaping at all. A test title is user text — bashunit::set_test_title takes anything, and a data provider interpolates values into it — and it goes straight into the table:

function test_titled() {
  bashunit::set_test_title "<script>alert(1)</script> & <b>bold</b>"
  assert_same 1 1
}

<td><script>alert(1)</script> & <b>bold</b></td>

So a < corrupts the table, a bare & is invalid entity syntax, and a title containing a script tag runs in whoever opens the report — which for a CI artifact is a browser. Every other writer escapes: JUnit emits </&/', JSON escapes quotes and backslashes. HTML is the one that does not.

Second defect, same cause

Rows are joined into a temp file with | and split back on it, so a title containing a pipe shifts every column:

<tr class="after">          <!-- status cell became a CSS class that does not exist -->
  <td>before</td>           <!-- title truncated -->
  <td>after</td>            <!-- status column shows the rest of the title -->
  <td>passed|13</td>        <!-- time column shows status and time -->
</tr>

The row also loses its colour, since class="after" matches no rule.

Fix

Separate the fields with US (0x1f) instead of |, and escape &, <, > and " in one awk pass over the collected rows.

awk rather than ${var//&/&} for the reason this repo already recorded in #1096: a bare & in a bash replacement means "the matched text" from 5.2 on while staying literal on 3.2, and no spelling is right across the supported range. The same rule applies to gsub, hence the escaped \\&. The separator is passed to awk as a byte rather than written as \x1f, which is not POSIX awk (#1098).

One pass over the file, so the cost is one fork per report rather than one per test.

[Chemaclass]

Done in #1250 (merged).