SECURITY: XSS with title selector on preferences page

Note this is very low severity as the group needs to be created with a
default title that contains HTML, and group creation is restricted to
staff members right now.

app/assets/javascripts/discourse/models/user.js.es6

@@ -748,7 +748,9 @@ const User = RestModel.extend({
       }
     });
 
-    return _.uniq(titles).sort();
+    return _.uniq(titles)
+      .sort()
+      .map(Ember.Handlebars.Utils.escapeExpression);
   },
 
   @computed("user_option.text_size_seq", "user_option.text_size")