escape_javascript potentially unsafe values in JS or HTML attributes

[jkraemer]

• in particular, _template_pulldown.html.erb and _issue_select_form.html.erb allowed code injection via the tracker namem, the latter also did not escape is_triggered_by, which comes from a request parameter

[jkraemer]

ping?