fix: centralize render escaping (v1.2.3)

[masonlet]

Moves HTML escaping from parseQueryParams to the render layer, so all text is escaped exactly once at the point it enters markup:

• renderSvg now escapes title, was escaped during parsing
• createLegend now escapes language names, was unescaped
• rename resolveColour to resolveThemeColour
• parseQueryParams now returns chartTitle unescaped