Stop calling Html::escape() for checkbox options

I'm sure this clean-up could be backported to 9.5

For role names escaping was added in #2560863: #options for radios and checkboxes uses SafeMarkup::checkPlain() to escape - use Html::escape() instead → other places in #2545972: Remove all code usages SafeMarkup::checkPlain() and rely more on Twig autoescaping →

The last submitted patch, 2: 3352972-2.patch, failed testing. View results →

Able to reproduce failures

- admin/structure/views/nojs/display/frontpage/page_1/display_title (set name to <em>Page</em> and save frontpage view
- admin/structure/views/nojs/display/frontpage/feed_1/displays should display escaped

Here's how it looks

@Lendude I'm sure it needs your approval and roles like displays can have names with markup

Tried testing on 11.x

Able to replicate the issue following #6
But after applying the patch issue still shows.

I rebased the latest patch and tests are green.
But I did some manual testing and I think escaping the options is still needed.

For example if I create a role named <b>foo</b> then browse to /admin/config/content/formats/manage/basic_html.
Without the patch:

With the patch:

I think we automatically sanitize #options by calling Xss::filter() on it (which removes dangerous markup) so not escaping the options would not be dangerous but role names are not really supposed to contain HTML so interpreting it here could be confusing for admins.

So I think this could be closed as wontfix.

@smustgrave I think #6 is about explaining a test failure, not steps to reproduce this issue.
The test failed because the previous patch removed escaping in Attachment.php and Feed.php which causes a breaking change.
(I did not keep changes to these files in the MR.)