[Autocomplete] Escape remote data

[comnuoc]

Currently, the script does not escape remote data and may have XSS vulnerabilities.

render: {
    option: function (item: any) {
        return `<div>${item.text}</div>`;
    },
    item: function (item: any) {
        return `<div>${item.text}</div>`;
    },

Can we escape remote data by default? https://tom-select.js.org/docs/#render-templates

render: {
    option: function (item: any, escape:typeof escape_html) {
        return `<div>${escape(item.text)}</div>`;
    },
    item: function (item: any, escape:typeof escape_html) {
        return `<div>${escape(item.text)}</div>`;
    },

or escape data based on option options_as_html

[smnandre]

Are you feeling up for a PR ?

[comnuoc]

I'm sorry, I don't have time for now. Could you please help?