[SECURITY] Avoid XSS by correctly encoding typolink results

In order to avoid XSS through typolink, anchor text is encoded
correctly to be used in a HTML context. Fallback link texts of
links to pages are encoded per default in case lib.parseFunc
has not been configured.

Resolves: #88635
Releases: master, 9.5, 8.7
Security-Commit: b62f71c4e098156052ff33e775208981c2ef512b
Security-Bulletin: TYPO3-CORE-SA-2019-022
Change-Id: I76b0f06ad52a487e1aebc820531c11166ad45117
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62716


Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>