templates: escape query value in ping page

elem-go does not escape attribute values, so the raw query reaches
the rendered HTML verbatim. Pre-escape with html.EscapeString to prevent
reflected XSS.

Updates #3157

hscontrol/debug.go

@@ -361,7 +361,6 @@ func (h *Headscale) debugHTTPServer() *http.Server {
 
 		w.Header().Set("Content-Type", "text/html; charset=utf-8")
 		w.WriteHeader(http.StatusOK)
-		//nolint:gosec // elem-go auto-escapes all attribute values; no XSS risk.
 		_, _ = w.Write([]byte(templates.PingPage(query, result, nodes).Render()))
 	}))