Add proper escaping for dynamic values in login template

[im3dabasia1]

The dynamic values $title and $login_header_text in the login template are not properly escaped.

File: wp-login.php
Line Number: 217, and 222

Trac ticket: https://core.trac.wordpress.org/ticket/62436

### PR Description
Applied proper escaping to dynamic values in the login template:

• esc_html() for $title to safely render any special characters in the text.
• esc_html() for $login_header_text to ensure safe output of the login header text.

These changes enhance security by preventing potential XSS vulnerabilities.

@im3dabasia Good catch!
The PR looks good to me.

[sabernhardt]

#58305 (plus #59257 and #61125) already proposed escaping $login_header_text with esc_html(), and the ticket was closed. If this uses wp_kses() instead, it could allow img elements because some sites might remove the text-indent to have an image instead of the background.

The $title variable stands for the first parameter of the login_header() function ('Log In' by default). I did not think escaping the variable was necessary with the Core translatable strings, but ​some plugins use login_header() too. A few of them, such as Google Authenticator, even have esc_html__() in the parameter.

[audrasjb]

Yes, I concur with @sabernhardt's feedback: both strings have very broadly used filters, and stripping HTML –even with the proposed KSES implementation– from them would most certainly break a lot of plugins.

My opinion is to close this ticket as wontfix.