Merge branch 'escape-label-title' into 'master'

Correctly escapes label title in filters

Fixes #15522

See merge request !3880

app/assets/javascripts/labels_select.js.coffee

@@ -223,7 +223,7 @@ class @LabelsSelect
         fieldName: $dropdown.data('field-name')
         id: (label) ->
           if $dropdown.hasClass("js-filter-submit") and not label.isAny?
-            label.title
+            _.escape label.title
           else
             label.id