SSA is vulnerable to stored XSS in create ticket feature

[italovalcy]

When creating a new ticket, the user can insert javascript code and use it as a stored XSS.

Steps to reproduce:

1. use the source code feature of the rich text editor
2. insert any xss code (even a basic <script>alert(1)</script>)

Expected behavior:
filter out the malicious content

Actual behavior:
the malicious html content is stored

It is worth to mention that this is not only on the "edit as source code" feature. The attacker can also modify the content before submit.