In extended reports I'm making it possible for column titles to be user edited. since they will represent user input it
makes sense to escape on output. I think core makes sense as the place to do this as it is best practice
to escape all output in the smarty layer and I have tested that it still works fine