[FIX] web, stock: escape JSON error when downloading report

__Description of the issue:__

When something goes wrong while downloading a report file, a 500 error
is sent as JSON. However the frontend interprets this response as HTML
and then try to parse the text content as JSON.

Most of the time this works, but if the response contains any HTML tags,
like `<lambda>` from a Python stacktrace, the JSON response will get
misinterpreted as HTML instead of regular text, causing the subsequent
JSON interpretation to fail.

The end result for the user is that empty tracebacks will be displayed
instead of User Errors or actual tracebacks.

__Desired behavior:__

The JSON response is HTML escaped before being sent and will therefore
be correctly parsed and displayed to the user.

This basically restore what was done prior of #104594.

Enterprise: odoo/enterprise#36523
X-original-commit: 5999a7d336553053c5638f69344cdfbc84a8c681
Part-of: odoo/odoo#112453

addons/stock/controllers/main.py

@@ -4,6 +4,7 @@ from werkzeug.exceptions import InternalServerError
 
 from odoo import http
 from odoo.http import request
+from odoo.tools.misc import html_escape
 
 import json
 
@@ -33,9 +34,5 @@ class StockReportController(http.Controller):
                 'message': 'Odoo Server Error',
                 'data': se
             }
-            res = werkzeug.wrappers.Response(
-                json.dumps(error),
-                status=500,
-                headers=[("Content-Type", "application/json")]
-            )
+            res = request.make_response(html_escape(json.dumps(error)))
             raise InternalServerError(response=res) from e

addons/web/controllers/report.py

@@ -12,6 +12,7 @@ from werkzeug.urls import url_parse
 
 from odoo import http
 from odoo.http import content_disposition, request
+from odoo.tools.misc import html_escape
 from odoo.tools.safe_eval import safe_eval, time
 
 
@@ -143,11 +144,7 @@ class ReportController(http.Controller):
                 'message': "Odoo Server Error",
                 'data': se
             }
-            res = werkzeug.wrappers.Response(
-                json.dumps(error),
-                status=500,
-                headers=[("Content-Type", "application/json")]
-            )
+            res = request.make_response(html_escape(json.dumps(error)))
             raise werkzeug.exceptions.InternalServerError(response=res) from e
 
     @http.route(['/report/check_wkhtmltopdf'], type='json', auth="user")