Review use of mark_safe when building HTML code in template tags

[elichad]

          After reading https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html I think we should review our use of `mark_safe`, as `format_html` may be more appropriate.

Originally posted by @pbanaszkiewicz in #2553 (comment)

In the wake of #2567 I agree that this is a good idea.

[elichad]

High priority to investigate; can be re-assessed and re-prioritised once we know if/how much work there is to do & if there are any security problems that need to be addressed urgently.