fix(security): Escape theme variable in login page

Escape configured language in settings page

app/Views/login.php

@@ -32,7 +32,7 @@ $request = Services::request();
         ? 'flatly'
         : $config['theme']);
     ?>
-    <link rel="stylesheet" href="resources/bootswatch5/<?= "$theme" ?>/bootstrap.min.css">
+    <link rel="stylesheet" href="resources/bootswatch5/<?= esc("$theme") ?>/bootstrap.min.css">
     <link rel="stylesheet" href="css/login.css">
     <meta name="theme-color" content="#2c3e50">
 </head>

app/Views/partial/datepicker_locale.php

@@ -25,7 +25,7 @@ var pickerconfig = function(config) {
     }, <?php echo isset($config) ?>);
 };
 
-$.fn.datetimepicker.dates['<?= $config['language'] ?>'] = {
+$.fn.datetimepicker.dates['<?= esc($config['language']) ?>'] = {
     days: [
         "<?= lang('Calendar.sunday') ?>",
         "<?= lang('Calendar.monday') ?>",