User avatar can serve as an XSS vector

This exploit can be seen from the My Bamboo Dashboard where the user's avatar is displayed.

QA Notes

Verify correct encoding of alternate text of user's avatar is encoded correctly on other places e.g. When a user submits code changes

Steps to reproduce

1. Create a user and set full name to be

   <script>alert(666)</script>

2. Login as user and navigate to My Bamboo dashboard - the script will execute