Escape path in new merge request mail

app/views/notify/new_merge_request_email.html.haml

@@ -3,7 +3,7 @@
     #{link_to @merge_request.author_name, user_url(@merge_request.author)} created a merge request:
 
 %p.details
-  != merge_path_description(@merge_request, '→')
+  = merge_path_description(@merge_request, '→')
 
 - if @merge_request.assignees.any?
   %p

changelogs/unreleased/security-id-email-xss.yml

+---
+title: Escape path in new merge request mail
+merge_request:
+author:
+type: security