fix(setup): use safer `text` method instead of html to prevent possible XSS

see also https://api.jquery.com/html/
under "Additional Notes":
"Do not use these methods to insert strings obtained from untrusted sources such as URL query parameters, cookies, or form inputs. Doing so can introduce cross-site-scripting (XSS) vulnerabilities. Remove or escape any user input before adding content to the document. "

fixes #1072

src/public/app/setup.ts

@@ -110,7 +110,7 @@ async function checkOutstandingSyncs() {
 }
 
 function showAlert(message: string) {
-    $("#alert").html(message);
+    $("#alert").text(message);
     $("#alert").show();
 }