r=mrenvoize

Co-authored-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>

Portions by justdave r=mrenvoize
Portions by mrenvoize r=justdave

Co-authored-by: David Lawrence <dkl@mozilla.com>

Co-authored-by: Dylan William Hardison <dylan@hardison.net>

Backported from 6765ab04774eebf8ea0bd063566240b24ac28f15.

Bug 1433400 (CVE-2018-5123) Prevent cross-site image requests from leaking contents of certain fields due to regex search
r=jfearn,a=dylan

After https://github.com/bugzilla/bugzilla/commit/7d0c10e71498f2909f466fc0ccda1890595bd3ff,
the <option> used when no flag is set is displayed as 'X' in Safari. This is because WebKit
displays the label when provided as per the latest HTML specification:
- https://html.spec.whatwg.org/multipage/rendering.html#the-select-element-2
- https://html.spec.whatwg.org/multipage/forms.html#concept-option-label

Chrome/Blink also display the label in standards mode, but not in quirks mode. The proposed
fix is to use a whitespace as label instead of 'X'. This renders as empty in Firefox / Chrome
and Safari and is still recognized as valid HTML as per https://validator.w3.org.