### Apache Airflow version

2.5.0

### What happened

https://github.com/apache/airflow/pull/20888 enables the use of markup to style the `webserver.instance_name`.
However, if the instance name has HTML code, this will also be reflected in the `<title>` tag, as shown in the screenshot below.
![image](https://user-images.githubusercontent.com/562969/212091882-d33bb0f7-75c2-4c92-bd4f-4bc7ba6be8db.png)

This is not a pretty behaviour.

### What you think should happen instead

Ideally, if `webserver. instance_name_has_markup = True`, then the text inside the `<title>` should be stripped of HTML code.

For example:
- Set `webserver.instance_name` to some text with markup, like `<b style="color: red">title</b>`
- Set `webserver.Instance_name_has_markup` to `true`

This is how the `<title>` tag should look like:

```html
<title>DAGs - title</title>
```

Instead of:

```
<title>DAGs - &lt;b style=&#34;color: red&#34;&gt;title&lt;b&gt;</title>
```

### How to reproduce

- Airflow version 2.3+, which is [when this change has been introduced](https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html#instance-name-has-markup)
- Set `webserver.instance_name` to some text with markup, like `<b style="color: red">title</b>`
- Set `webserver.Instance_name_has_markup` to `true`


### Operating System

Doesn't matter

### Versions of Apache Airflow Providers

_No response_

### Deployment

Other

### Deployment details

_No response_

### Anything else

_No response_

### Are you willing to submit PR?

- [X] Yes I am willing to submit a PR!

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)

"""Sync appbuilder roles to DB"""
    
    
    
    
    if conf.getboolean("webserver", "UPDATE_FAB_PERMS"):
        flask_app.appbuilder.sm.sync_roles()
def create_app(config=None, testing=False):
    """Create a new instance of Airflow WWW app"""
    flask_app = Flask(__name__)
    flask_app.secret_key = conf.get("webserver", "SECRET_KEY")
    flask_app.config["PERMANENT_SESSION_LIFETIME"] = timedelta(minutes=settings.get_session_lifetime_config())
    flask_app.config.from_pyfile(settings.WEBSERVER_CONFIG, silent=True)
    flask_app.config["APP_NAME"] = conf.get(section="webserver", key="instance_name", fallback="Airflow")
    flask_app.config["TESTING"] = testing
    flask_app.config["SQLALCHEMY_DATABASE_URI"] = conf.get("database", "SQL_ALCHEMY_CONN")
    url = make_url(flask_app.config["SQLALCHEMY_DATABASE_URI"])
    if url.drivername == "sqlite" and url.database and not url.database.startswith("/"):
        raise AirflowConfigException(
            f'Cannot use relative path: `{conf.get("database", "SQL_ALCHEMY_CONN")}` to connect to sqlite. '
            "Please use absolute path such as `sqlite:////tmp/airflow.db`."
        )
    flask_app.config["SQLALCHEMY_TRACK_MODIFICATIONS"] = False