wfEscapeWikiText() is incorrect in this context. It escapes
HTML, but also escapes a whole bunch of other stuff that
is not needed here
Also: Prefer html::element for escaping, because it makes it
easier to see at a glance everything is escaped.
Change-Id: I91b0722ea98f1e20339c7e0aa839c1073b778ed5