[markdown-it-toc] markdown-it-toc Cross-site Scripting due to title of generated toc and contents of header not being escaped

This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-28455
• https://security.snyk.io/vuln/SNYK-JS-MARKDOWNITTOC-1044067
• https://github.com/advisories/GHSA-wfvx-fx73-3rfj