Properly HTML escape fields for label template placeholders

Fixes issue #1446

src/Services/LabelSystem/Barcodes/BarcodeHelper.php

@@ -67,8 +67,8 @@ class BarcodeHelper
     {
         $svg = $this->barcodeAsSVG($content, $type);
         $base64 = $this->dataUri($svg, 'image/svg+xml');
-        $alt_text ??= $content;
-        
+        $alt_text ??= htmlspecialchars($content);
+
         return '<img src="'.$base64.'" width="'.$width.'" style="min-height: 25px;" alt="'.$alt_text.'"/>';
     }
 
@@ -94,4 +94,4 @@ class BarcodeHelper
 
         return $repr;
     }
-}
+}