[FIX] Sanitize modification-history entries in alert history modal

user and action come from modification_history, which embeds the
acting user's username verbatim. They were appended as raw HTML via
jQuery .append(), so a username containing HTML/script executed when
an analyst opened the alert history modal.

Author: Che4ter

ui/src/pages/alerts.js

@@ -1294,7 +1294,7 @@ async function showAlertHistory(alertId) {
         let date = new Date(Math.floor(entry) * 1000);
         let dateStr = date.toLocaleString();
         let entryStr = alertData.modification_history[entry];
-        entryDiv.append('<div class="row"><div class="col-3">' + dateStr + '</div><div class="col-3">' + entryStr.user + '</div><div class="col-6">'+ entryStr.action +'</div></div>');
+        entryDiv.append('<div class="row"><div class="col-3">' + dateStr + '</div><div class="col-3">' + sanitizeHTML(entryStr.user) + '</div><div class="col-6">'+ sanitizeHTML(entryStr.action) +'</div></div>');
 
     }