Properly escape output of the ms_user_list_site_class filter

[david.binda]

In r44977 a new filter was added, based on the proposal in #41146. However, the output of the classes added via new filter is incorrect.

sanitize_html_class is being used for escaping an output, which has 2 flaws:

1) an escaping function should be used (eg.: esc_attr)
2) sanitize_html_class does not allow spaces on it's output ( only [A-Za-z0-9_-] ), so the implode( ' ' ) is being reverted and all new classes added via filter are concatenated w/o space in between them.

To mitigate the issue, esc_attr should be used in https://core.trac.wordpress.org/browser/trunk/src/wp-admin/includes/class-wp-ms-users-list-table.php?rev=44977#L355 instead of the sanitize_html_class.

[SergeyBiryukov]

In 45252:

Networks and Sites: Use correct escaping function for classes added via ms_user_list_site_class filter.

Props david.binda.
Fixes #46990. See #41146.