fix: escape use input in debug route

[TylerHelmuth]

Which problem is this PR solving?

• The debug endpoint doesn't sanitize the user input before using it in the response.

Short description of the changes

• use html.EscapeString to escape the user's input string for use in refinery and the response.

[kentquirk]

Sadly, you can't put it here, because it might calculate the wrong shard destination for the trace. You need to move the EscapeString call to be around the traceID in the sprintf and not affect the shard calculation.

[TylerHelmuth]

@kentquirk updated

[kentquirk]

LGTM