Fix HTML injection in hwqueue comparison report generator

[Copilot]

Dynamic values (baseline_label, test_label, workload names, verdict strings) were interpolated directly into HTML without escaping, enabling HTML injection via user-provided labels or filenames containing <, &, or quotes.

Changes

• import html added to hwqueue_html.py
• _generate_comparison_verdict_html: escape baseline_label, test_label, summary.verdict, summary.verdict_class, summary.top_improvement[0], and summary.top_regression[0] before HTML interpolation
• generate_comparison_html: escape baseline_label and test_label used in the report body <strong> tags

# Before
<h2>📊 Comparison Summary: {baseline_label} → {test_label}</h2>
<td>{summary.top_improvement[0]}</td>

# After
safe_baseline = html.escape(baseline_label)
safe_test = html.escape(test_label)
safe_top_improvement = html.escape(summary.top_improvement[0])

<h2>📊 Comparison Summary: {safe_baseline} → {safe_test}</h2>
<td>{safe_top_improvement}</td>

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.