[SECURITY] Prevent XSS in FormManager backend module

Encode non prepared output of BackendUtility::getRecordTitle.
The string returned by getRecordTitle is only HTML encoded if
the third parameter (`$prep`) is set to true, ensure that
non-prepared usages are encoded on render.

Resolves: #103782
Releases: main, 13.1, 12.4, 11.5
Change-Id: I96b9530d118a21163d6679ebf7120aa40c7ac7b6
Security-Bulletin: TYPO3-CORE-SA-2024-008
Security-References: CVE-2024-34356
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/84254


Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>