[FIX] Sanitize alert title in asset linked-alerts popover

alert_title was only quote-escaped before being embedded in the
popover's HTML content, so a title containing unquoted HTML (e.g. an
img tag with an onerror handler) still executed. Run it through
sanitizeHTML before the quote-escaping used for the attribute context.

Author: Che4ter

ui/src/pages/case.asset.js

@@ -401,7 +401,7 @@ $(document).ready(function(){
                         let alerts_content = "";
 
                         row.alerts.forEach(alert => {
-                            alerts_content += `<i tabindex="0" class="fas fa-bell text-warning mr-2"></i><a href=\"/alerts?alert_ids=${alert.alert_id}&page=1&per_page=1&sort=desc\" target="_blank" rel="noopener">#${alert.alert_id} - ${alert.alert_title.replace(/'/g, "&#39;").replace(/"/g, "&quot;")}</a><br/>`;
+                            alerts_content += `<i tabindex="0" class="fas fa-bell text-warning mr-2"></i><a href=\"/alerts?alert_ids=${alert.alert_id}&page=1&per_page=1&sort=desc\" target="_blank" rel="noopener">#${alert.alert_id} - ${sanitizeHTML(alert.alert_title).replace(/'/g, "&#39;").replace(/"/g, "&quot;")}</a><br/>`;
                         }  );
                         alerts_content += `<i tabindex="0" class="fas fa-external-link-square mr-2"></i><a href=\"/alerts?alert_assets=${data}" target="_blank" rel="noopener">More..</a>`;