add_display_time: Note unescaped variable

(imported from commit 17d683e2bf0e5eabfb1cb2cdb6a1db18d140b5c9)

zephyr/static/js/zephyr.js

@@ -241,6 +241,7 @@ function add_display_time(message, prev) {
         }
     }
 
+    // NB: timestr is HTML, inserted into the document without escaping.
     if (include_date) {
         message.timestr = time.toString("MMM dd") + "  " +
             time.toString("HH:mm");