Unescaped message used in HTML within LogEventsList

More info at https://phabricator.wikimedia.org/T256171...

Authorization Bypass

mediawiki/core is vulnerable to authorization bypass. The vulnerability exists as the userCan function in includes/logging/LogEventsList.php does not properly check the user's permissions for the action...