fix: Escape HTML in display_explanations to prevent stored XSS

[instantraaamen]

Description

display_explanations() in notebook_utils.py renders column names and cell values from evaluation DataFrames directly into IPython.display.HTML() without escaping. If a DataFrame contains crafted HTML/JS payloads (e.g. from a shared dataset or model output), they execute in the user's Colab/Jupyter session.

This applies html.escape() to both column headers and cell values before interpolation, matching the pattern already used in _evals_visualization.py.

Fixes both vertexai/evaluation and vertexai/preview/evaluation paths.

Reproducer

importpandasaspdfromunittest.mockimportMagicMockevil_df=pd.DataFrame({
'<img src=x onerror=alert("XSS")>': ['<script>alert(1)</script>']
})
eval_result=MagicMock()
eval_result.metrics_table=evil_dffromvertexai.evaluation.notebook_utilsimportdisplay_explanationsdisplay_explanations(eval_result=eval_result)
# Before fix: alert box fires# After fix: escaped safely