### Apache Airflow version

2.5.0

### What happened

https://github.com/apache/airflow/pull/20888 enables the use of markup to style the `webserver.instance_name`.
However, if the instance name has HTML code, this will also be reflected in the `<title>` tag, as shown in the screenshot below.
![image](https://user-images.githubusercontent.com/562969/212091882-d33bb0f7-75c2-4c92-bd4f-4bc7ba6be8db.png)

This is not a pretty behaviour.

### What you think should happen instead

Ideally, if `webserver. instance_name_has_markup = True`, then the text inside the `<title>` should be stripped of HTML code.

For example:
- Set `webserver.instance_name` to some text with markup, like `<b style="color: red">title</b>`
- Set `webserver.Instance_name_has_markup` to `true`

This is how the `<title>` tag should look like:

```html
<title>DAGs - title</title>
```

Instead of:

```
<title>DAGs - &lt;b style=&#34;color: red&#34;&gt;title&lt;b&gt;</title>
```

### How to reproduce

- Airflow version 2.3+, which is [when this change has been introduced](https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html#instance-name-has-markup)
- Set `webserver.instance_name` to some text with markup, like `<b style="color: red">title</b>`
- Set `webserver.Instance_name_has_markup` to `true`


### Operating System

Doesn't matter

### Versions of Apache Airflow Providers

_No response_

### Deployment

Other

### Deployment details

_No response_

### Anything else

_No response_

### Are you willing to submit PR?

- [X] Yes I am willing to submit a PR!

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)

resp = admin_client.post("task_stats", follow_redirects=True)
    assert resp.status_code == 200
@conf_vars({("webserver", "instance_name"): "Site Title Test"})
def test_page_instance_name(admin_client):
    resp = admin_client.get("home", follow_redirects=True)
    check_content_in_response("Site Title Test", resp)
def test_page_instance_name_xss_prevention(admin_client):
    xss_string = "<script>alert('Give me your credit card number')</script>"
    with conf_vars({("webserver", "instance_name"): xss_string}):
        resp = admin_client.get("home", follow_redirects=True)
        escaped_xss_string = "&lt;script&gt;alert(&#39;Give me your credit card number&#39;)&lt;/script&gt;"
        check_content_in_response(escaped_xss_string, resp)
        check_content_not_in_response(xss_string, resp)
@conf_vars(
    {
        ("webserver", "instance_name"): "<b>Bold Site Title Test</b>",
        ("webserver", "instance_name_has_markup"): "True",
    }
)
def test_page_instance_name_with_markup(admin_client):
    resp = admin_client.get("home", follow_redirects=True)
    check_content_in_response("<b>Bold Site Title Test</b>", resp)