XSS protection when displaying repo data

[laurentsimon]

This is just a placeholder issue to keep track of the way we'll sanitize the scorecard results (data from repos is considered untrusted). I think this will be combination of input sanitization, CSP and frame sandbox attributes. Depends very much on web framework we use. Need to explore a little more.

To keep in mind during design.