Potential fix for code scanning alert no. 4: Reflected cross-site scripting

[aramprice]

Potential fix for https://github.com/cloudfoundry/go-fetcher/security/code-scanning/4

To fix this safely without changing behavior, escape untrusted or potentially untrusted values before inserting them into HTML attribute values. In this function, the cleanest fix is to HTML-escape the final goImportContent and goSourceContent values when building the meta tags.

Best single approach in this file:

• Add html to imports.
• On lines constructing goImport and goSource, wrap the content values with html.EscapeString(...).
• Keep all existing logic, logging, redirects, and response format unchanged except proper escaping in emitted HTML.

This preserves functionality (same metadata semantics) while preventing attribute/context injection via repoName (and any other unexpected characters in composed content).

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[aramprice]

GitHub workers are currently having issues, which is causing the PR checks to timeout:
=> https://www.githubstatus.com/