This fixes #1144490 which is a previously missed corner case of
CVE-2018-0499.  It's a missing HTML escaping bug.

It affects upstream releases 1.4.x for x <= 31 and 2.0.0.
Upstream releases 1.4.32 and 2.1.0 include a fix, and I've already
uploaded 1.4.32-1 to unstable and 2.1.0-1 to experimental.

I've already contacted the security team who decided it was more
appropriate to handle via a stable update.

[ Impact ]
There's potential for unescaped data appearing in HTML search result
pages.  It is only exploitable with a particular combination of
parameters which don't seem to be commonly used in practice (I search
codesearch.d.n and didn't locate any examples, though `snippet` is a
fairly common function name, and it may be used in code people run on
Debian which isn't packaged for Debian).

Exploitation would generally also require the attacker can supply
documents to the search system, or find suitable document content
already in the system.

[ Tests ]
The patch include regression tests which are automatically run during
the package build.

[ Risks ]

This is a low risk change - the patch is small and not complex, and
just changes this code path to use existing escaping functionality
already used on other code paths.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
In the affected case, the return value is escaped rather than returned
as-is.

[ Other info ]
I wonder if this should be considered for the stable-updates suite
so users get the fix sooner?  While it seems an unusual use of the API,
for users affected the lack of company won't be much comfort, and it's
a low risk patch.

Cheers,
    Olly