fix: HTML-escape GA tracking pixel URL in ace template tag

The google_analytics_tracking_pixel tag wrapped the image URL in HTML()
and mark_safe(), marking it safe without escaping. Use format_html() so
the interpolated URL is HTML-escaped, resolving pylint W5151
(mark-safe-interpolation).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>