Sanitize $_SERVER['REQUEST_URI']

[tmuras]

$_SERVER['REQUEST_URI'] is used to construct HTML:
https://github.com/at-tools/moodle-block_massaction/blob/master/block_massaction.php#L123

The variable should be sanitized as it potentially allows for injecting HTML there.
REQUEST_URI is normally URL-encoded but that encoding is done by the browser, so it should not be trusted.