Decode entities in captions when using a token

PlainTextOutput::renderFromHtml() is ideal when you only want plain text in the captions, but there seems to be a case for HTML in them too (see #3263032: HTML links no longer work in custom captions → ), so I'm not sure this can always be appropriate.

I found I get double-escaped HTML in the captions, even when I don't use tokens for captions, because Xss::Filter() is used at the end of template_preprocess_colorbox_formatter(), regardless of the source of the caption. Regardless of the caption, the title attribute on the colorbox link produced by that formatter's template is double-escaped, from what I can see!

Now I realise this module has had security issues, but I wonder if this is a place where this is no longer appropriate? I think Twig auto-escaping would be sanitising the attributes array in the template already. But I'm not confident enough to know that wouldn't just open another security problem.