Fix handling of query parameters in examples

The examples were injecting the query parameters as HTML,
which allowed for arbitrary javascript to be ran (for ex. through
an `onerror` attribute on an image).

As the values in the query parameters only needs displaying, the query parameter
is now displayed via text content.

Author: romaricpascal

examples/ajax-source.html

@@ -292,8 +292,7 @@ <h1>Accessible Autocomplete AJAX source example</h1>
         var submittedEl = document.querySelector('.submitted')
         submittedEl.classList.remove('submitted--hidden')
         var params = new URLSearchParams(document.location.search.split('?')[1])
-        document.querySelector('.submitted__last-location').innerHTML = params.get('last-location')
-        document.querySelector('.submitted__passport-location').innerHTML = params.get('passport-location')
+        document.querySelector('.submitted__last-location').textContent = params.get('last-location')
       }
     </script>
   </body>

examples/form-single.html

@@ -374,7 +374,7 @@ <h1>Accessible Autocomplete single field form example</h1>
         var submittedEl = document.querySelector('.submitted')
         submittedEl.classList.remove('submitted--hidden')
         var params = new URLSearchParams(document.location.search.split('?')[1])
-        document.querySelector('.submitted__last-location').innerHTML = params.get('last-location')
+        document.querySelector('.submitted__last-location').textContent = params.get('last-location')
       }
     </script>
   </body>

examples/form.html

@@ -665,8 +665,8 @@ <h1>Accessible Autocomplete form example</h1>
         var submittedEl = document.querySelector('.submitted')
         submittedEl.classList.remove('submitted--hidden')
         var params = new URLSearchParams(document.location.search.split('?')[1])
-        document.querySelector('.submitted__last-location').innerHTML = params.get('last-location')
-        document.querySelector('.submitted__passport-location').innerHTML = params.get('passport-location')
+        document.querySelector('.submitted__last-location').textContent = params.get('last-location')
+        document.querySelector('.submitted__passport-location').textContent = params.get('passport-location')
       }
     </script>
   </body>