MDL-87066 core: add clean_string() to solve double encoding in Mustache

The idea is to prevent double escaping in s()
and mustache.escape() by using numeric html
entities to sanitise result of format_string(),
get_string() and similar.

lib/tests/text_test.php

@@ -465,6 +465,38 @@ final class text_test extends advanced_testcase {
         $this->assertSame('', core_text::encode_mimeheader(null));
     }
 
+    /**
+     * Tests conversion of named to numeric html entities.
+     *
+     * @covers ::entities_named_to_numeric()
+     */
+    public function test_entities_named_to_numeric(): void {
+        $str = '& " < >';
+        $this->assertSame('& " < >', core_text::entities_named_to_numeric($str));
+
+        $str = 'Žluťoučký koníček testing Ι';
+        $this->assertSame('Žluťoučký koníček testing Ι', core_text::entities_named_to_numeric($str));
+
+        $str = "Žluťoučký koníček©"&<>§«";
+        $this->assertSame(
+            "Žluťoučký koníček©"&<>§«",
+            core_text::entities_named_to_numeric($str)
+        );
+
+        $this->assertSame(
+            core_text::entities_to_utf8($str),
+            core_text::entities_to_utf8(core_text::entities_named_to_numeric($str))
+        );
+
+        $table = get_html_translation_table(HTML_ENTITIES, ENT_COMPAT | ENT_HTML401, 'UTF-8');
+        $entities = implode(' ', $table);
+        $chars = implode(' ', array_keys($table));
+        $this->assertSame(
+            core_text::entities_to_utf8($chars),
+            core_text::entities_to_utf8(core_text::entities_named_to_numeric($entities))
+        );
+    }
+
     /**
      * Tests the static entities_to_utf8 method.
      *