Don't overescape tab links

[braders]

Overview

Don't overescape tab links, ensure tabs work when escape-on-output is enabled.

Before

Tabs failed to load. E.g.:

• Contact page
• Manage event page

After

Tabs load

Technical Details

This does not affect Drupal due to the difference in URL structure between environments, and the short-circuits already in place to make escape-on-output work.

Comments

Possibly there should be an escape method for URLs - something like esc_url in WordPress. The risk of leaving these unescaped seems low though, and is no worse than the status quo (i.e. without escape-on-output).

[civibot]

(Standard links)

• If this is your first pull-request for CiviCRM, please browse CONTRIBUTING.md for information about the development and testing processes.
• If you are reviewing this pull-request, you may wish to consult the test sites and the Review Standards (long template, short template).

[eileenmcnaughton]

I agree the risk is low

In general escaping if for when the variable comes from user input & where the php layer constructs the variable it should not be needed (assuming we don't stuff anything up....)