Protocol-service js scripts can be executed on html preview from string fields

Summary: scripts can be executed

STR:

1. Go to /api/procedures/ endpoint
2. Create procedure with next body:

{
    "auctionPeriod": {
        "startDate": "2020-12-31T09:19:00+00:00"
    },
    "previousAuctionId": "UA-PS-1999-12-12-000000-0",
    "sellingMethod": "subsoil-dutch",
    "sellingEntity": {
        "identifier": {
            "scheme": "UA-EDR",
            "legalName": {
                "uk_UA": "<script>document.body.style.backgroundColor='#f3f3f3'; alert('test');</script>",
                "en_US": "string"
            },
            "id": "12345678"
        },
        "address": {
            "addressID": {
                "scheme": "koatuu",
                "id": "0110136600"
            },
            "streetAddress": {
                "uk_UA": "ва",
                "en_US": "string"
            },
            "locality": {
                "uk_UA": "2",
                "en_US": "string"
            },
            "region": {
                "uk_UA": "Автономна Республіка Крим",
                "en_US": "string"
            },
            "countryName": {
                "uk_UA": "Україна"
            }
        },
        "contactPoint": {
            "email": "Tadmin@example.com",
            "telephone": "+380123456789",
            "name": {
                "uk_UA": "string",
                "en_US": "string"
            },
            "url": "http://string.com"
        },
        "representativeInfo": "Довіреність № 123 від 22.02.2012, дійсна до 30.03.2012/Наказ № 142 від 14.12.2019/Статут ТОВ Кульбаба від 24.07.2002"
    },
    "title": {
        "uk_UA": "ы",
        "en_US": "string"
    },
    "description": {
        "uk_UA": "string",
        "en_US": "string"
    },

    "x_documentRequirements": {
        "uk_UA": "string",
        "en_US": "string"
    },

    "value": {
        "currency": "UAH",
        "amount": 10,
        "valueAddedTaxIncluded": true
    },
    "discount": {
        "previousAuctionValue": {
            "currency": "UAH",
            "amount": 11,
            "valueAddedTaxIncluded": true
        },
        "discountPercent": 10.5,
        "discount": true
    },
    "guarantee": {
        "currency": "UAH",
        "amount": 10,
        "valueAddedTaxIncluded": true
    },
    "tenderAttempts": 3,
    "leaseDuration": "P1Y00M30D",
    "items": [
        {
            "description": {
                "uk_UA": "string",
                "en_US": "string"
            },
            "classification": {
                "scheme": "CAV",
                "id": "41100000-0"
            },
            "unit": {
                "code": "H87"
            },
            "quantity": 11.1126,
            "address": {
                "addressID": {
                    "scheme": "koatuu",
                    "id": "0110136600"
                },
                "streetAddress": {
                    "uk_UA": "string",
                    "en_US": "string"
                },
                "locality": {
                    "uk_UA": "string",
                    "en_US": "string"
                },
                "region": {
                    "uk_UA": "Автономна Республіка Крим",
                    "en_US": "string"
                },
                "postalCode": "string",
                "countryName": {
                    "uk_UA": "Україна"
                }
            },
            "additionalClassifications": [
                   {
                    "scheme": "subsoilUsageType",
                    "id": "01"
                }
            ]
        }
    ],
    "dutchStep": {"dutchStepQuantity":90}
}

3. Upload 'cancellaionDetails' document
4. Cancel procedure with next body:

{
    "reason": {
        "uk_UA": "1",
        "en_US": "Cancellation reason"
    },
    "documents": [
        {
            "title": {
                "uk_UA": "Назва",
                "en_US": "Title"
            },
            "documentOf": "cancellation",
            "token": ""
        }
    ],
    "datePublished": "2020-12-15T09:14:48.975695+00:00"
}

5. Create protocol in html using /api/protocol/{auction_id}/print endpoint

Protocol example: https://procedure-dev.prozori.in.ua/api/protocol/SUE001-UA-20201215-38252/print

Actual result: Scripts executed

Expected result: shouldn't be executed