Merge pull request #3781 from overleaf/jpa-xss-18

[views] mitigate Angular XSS in the user-activate module

GitOrigin-RevId: 88a4501699b92e33c7ee120d180e60825d82fbd5

services/web/modules/user-activate/app/views/user/activate.pug

@@ -23,6 +23,7 @@ block content
 								type="hidden",
 								name="passwordResetToken",
 								value=token
+								ng-non-bindable
 							)
 							.alert.alert-danger(ng-show="activationForm.response.error")
 								| #{translate("activation_token_expired")}