Linkit: more specific label sanitization

linkit-entity-matcher-sanitizer.patch

diff --git a/src/Plugin/Linkit/Matcher/EntityMatcher.php b/src/Plugin/Linkit/Matcher/EntityMatcher.php
index a8a85c8..be57dfa 100644
--- a/src/Plugin/Linkit/Matcher/EntityMatcher.php
+++ b/src/Plugin/Linkit/Matcher/EntityMatcher.php
@@ -3,6 +3,7 @@
 namespace Drupal\linkit\Plugin\Linkit\Matcher;
 
 use Drupal\Component\Utility\Html;
+use Drupal\Component\Utility\Xss;
 use Drupal\Core\Config\Entity\ConfigEntityTypeInterface;
 use Drupal\Core\Database\Connection;
 use Drupal\Core\Entity\EntityInterface;
@@ -406,7 +407,7 @@ class EntityMatcher extends ConfigurableMatcherBase {
    *   The label for this entity.
    */
   protected function buildLabel(EntityInterface $entity) {
-    return Html::escape($entity->label());
+    return Xss::filter($entity->label());
   }
 
   /**