[Search,Dropdown,XSS] prevent JS execution from manual entries or untrusted remote data

[lubber-de]

Description

This PR sanitizes the probably fetched and vulnerable HTML Data for dropdown user additions aswell as for search response values.

For search an additional option preserveHTML (default true) (adopted from dropdown where this is already available). When this is set to false every result value from the response stream will be sanitized in the default templates.

Testcase

unfixed dropdown
https://jsfiddle.net/9x8tqdam/

fixed dropdown
https://jsfiddle.net/9x8tqdam/1/

To test search you need to setup something locally to fake evil remote api data:

<div class="ui search">
  <div class="ui left icon input">
    <input class="prompt" type="text" placeholder="Search GitHub">
    <i class="github icon"></i>
  </div>
</div>

Initialize the search specifying a url which points to some evil prepared fakeapi.json-file to simulate a vulnerable remote api site

$('.ui.search')
  .search({
	preserveHTML: false, //add this to be safe to untrusted remote data
	apiSettings: {
	  url: 'fakeapi.json'
	},
	fields: {
	  title: 'name' //,
	},
	searchFields: [
	  'name'
	]
  })
;

The evil fakeapi.json could look like

{
  "success": true,
  "results": [{
    "name": "<script>alert('gotcha')</script>African Elephant",
    "value": "african-elephant"
  }, {
    "name": "African Wild Dog",
    "value": "african-wild dog"
  }, {
    "name": "Albacore Tuna",
    "value": "albacore-tuna"
  }]
}

Closes

Semantic-Org/Semantic-UI#4498
Semantic-Org/Semantic-UI#6571
Semantic-Org/Semantic-UI#3318

Relates to

Semantic-Org/Semantic-UI#6570
Semantic-Org/Semantic-UI#5376
Semantic-Org/Semantic-UI#1033
Semantic-Org/Semantic-UI#4592

To fulfill the demands of the above mentioned issues i will add appropriate security-informations to the docs once this PR is approved and merged

[y0hami]

LGTM

[prudho]

LGTM

[lubber-de]

I forgot to sanitize the dropdown templates respecting the preserveHTML setting.
Please review again

[y0hami]

LGTM

[prudho]

LGTM