Escape HTML in commit titles in system note messages

Adding <pre> in the commit tags would result in something like this:

Now we escape all HTML to get this:

Closes #17348 (closed)