`subject` field is wrongly XML escaped in the OCS API

[ogoffart]

This is a spinoff of https://github.com/owncloud/client/issues/5576 (see the screenshot there)

Steps to reproduce

1. Modify a file that has a single quote in it's name (')
2. Query ocs/v1.php/cloud/activity?format=json
3. Observe that the file name in the data's subject field is XML escaped, (while the file field is not)

Also if you don't use format=json, the file name is escaped twice.

Expected behaviour

It should be consistent, and none of the field should be XML escaped in the JSON.

Actual behaviour

The subject field is XML escaped.