Django: A security improvement coming to format_html()

Why format_html() can be dangerous, how to fix it, and why Django 5.0+ now has a patch fixing the issue.