Notifications RSS feed doesn't escape HTML

Steps to reproduce:

1. As a user with some HTML code in the name (like <script>alert(1)</script>), do some change on a document that is watched by another user. Additionally, set the title of the changed document to contain similar HTML code.
2. As the other user, click on the feed icon in the notifications area.

Expected result:

The user's name is displayed as entered as is the title of the changed document.

Actual result:

The text <script>alert(1)</script> isn't displayed in the content of the item unless you view the source, in which case you can see that the HTML code hasn't been escaped. This can break the formatting of the feed or might trigger security issues in the feed reader if it doesn't prevent JavaScript execution. Note that normally, feed readers shouldn't execute JavaScript that is contained in the feed's content as they should consider the feed's content as untrusted input so this is not a security issue in XWiki.