Accessibility: Ensure only text is sent to aria-live messages.

While messages passed to `wp.speak.a11y()` should preferably be meaningful,
short, and carefully crafted case by case, this will ensure any HTML tags will
be stripped out from the message string.

Props adamsilverstein.
Fixes #37382.

git-svn-id: https://develop.svn.wordpress.org/trunk@38115 602fd350-edb4-49c9-b593-d223f7449a82

src/wp-includes/js/wp-a11y.js

@@ -20,6 +20,9 @@ window.wp = window.wp || {};
 		// Clear previous messages to allow repeated strings being read out.
 		clear();
 
+		// Ensure only text is sent to screen readers.
+		message = $( '<p>' ).html( message ).text();
+
 		if ( $containerAssertive && 'assertive' === ariaLive ) {
 			$containerAssertive.text( message );
 		} else if ( $containerPolite ) {