GHSA-62r2-gcxr-426x

### Summary
A user with the `editmyprivateinfo` right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload.

### Details
Here's the offending line:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/d45c3d69f30863f622f16eb40dd41d3ca943454a/includes/Components/CitizenComponentUserInfo.php#L137

This was introduced in 717d16af35b10dab04d434aefddbf991fc8c168c

### PoC
1. Login
2. Go to Special:Preferences
3. Set the real name field to a string like `<script>alert("Admin with a propensity for self-XSSes")</script>`
4. Save your settings and use Citizen if it's not being used already


### Impact
Any user who can change their name (whether it's through the editmyprivateinfo right or through other means) can add XSS payloads that trigger for themselves only.