XSS vulnerability in facet results

I have added a patch for this.

The Html class is not called correctly (the namespace is missing):

Class "Drupal\facets_autocomplete\Plugin\facets\widget\Html" not found

Please review this

This fixes the vulnerability but redirects to /undefined when selecting a value.
I think this happens because in autocomplete-widget.js this.getElementsByTagName("input")[0].value gets the value as unescaped HTML and then tries to use it as key for the URL array where it is escaped.

I don't think you need to escape the $automplete_urls key.

Implement the fix with the comments to fix the undefined.

There's a small issue still that I create an extra ticket for on #3457555

Automatically closed - issue fixed for 2 weeks with no activity.