Potential XSS vulnerability in sortbyweight Twig filter

Problem/Motivation

When passing a string to the sortbyweight Twig filter, it returns it unchanged but because the filter has 'is_safe' => ['html'], it will mark the string as safe and disable Twig auto escaping.

This could lead to a XSS vulnerability if the filter is used on a string provided by users.

This is mitigated by the fact the module only uses this filter on render arrays, but a custom template could be vulnerable.

Steps to reproduce

{# Dangerous user-provided value #}
{% set payload = '<script>alert(`XSS`);</script>' %}

{# Here it is correctly escaped #}
{{ payload }}

{# Here it is not #}
{{ payload|sortbyweight }}

Proposed resolution

Since the filter usually returns an array, I don't think it needs to use is_safe