security: escape the returned paths of files and directories.

Nodes function is used for autocomplete in files view, it prevents from
XSS type of attack in file search.

rhodecode/model/scm.py

@@ -496,7 +496,7 b' class ScmModel(BaseModel):'
 
                     if not flat:
                         _data = {
-                            "name": f.unicode_path,
+                            "name": h.escape(f.unicode_path),
                             "type": "file",
                             }
                         if extended_info:
@@ -522,7 +522,7 b' class ScmModel(BaseModel):'
                     _data = d.unicode_path
                     if not flat:
                         _data = {
-                            "name": d.unicode_path,
+                            "name": h.escape(d.unicode_path),
                             "type": "dir",
                             }
                     if extended_info: