fix reflected xss when returning errors on web endpoint

Reported by Filippo Decortes from ares-cyber.ai

Cargo.lock

@@ -1679,6 +1679,7 @@ dependencies = [
  "garage_model",
  "garage_table",
  "garage_util",
+ "html-escape",
  "http 1.4.0",
  "http-body-util",
  "hyper 1.8.1",
@@ -1949,6 +1950,15 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "html-escape"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d1ad449764d627e22bfd7cd5e8868264fc9236e07c752972b4080cd351cb476"
+dependencies = [
+ "utf8-width",
+]
+
 [[package]]
 name = "http"
 version = "0.2.12"
@@ -4820,6 +4830,12 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "utf8-width"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1292c0d970b54115d14f2492fe0170adf21d68a1de108eebc51c1df4f346a091"
+
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"