Use textContent instead of innerHTML for extracting logs from headless browser tests

Easier to maintain fidelity and less likely to be sabotaged by XSS and
`<script>` tags.

Fixes #1232

crates/cli/src/bin/wasm-bindgen-test-runner/index-headless.html

@@ -13,7 +13,7 @@
      const orig = id => (...args) => {
          const logs = document.getElementById(id);
          for (let msg of args) {
-             logs.innerHTML += `${msg}\n`;
+             logs.textContent += `${msg}\n`;
          }
      };
 

crates/cli/src/bin/wasm-bindgen-test-runner/server.rs

@@ -30,7 +30,7 @@ pub fn spawn(
         // Now that we've gotten to the point where JS is executing, update our
         // status text as at this point we should be asynchronously fetching the
         // wasm module.
-        document.getElementById('output').innerHTML = "Loading wasm module...";
+        document.getElementById('output').textContent = "Loading wasm module...";
 
         async function main(test) {{
             // this is a facet of using wasm2es6js, a hack until browsers have