update ibisclient to 1.2.8 release

Git uis references

bugfix: "single select" control not initialising (introduced single_user on ucamlookup_users.html to initialise "single select")

..and bump version to 1.9.1

The invocation of Jquery select2 to provide searchable dropdowns
didn't sanitise data coming fom lookup, with the result that any
HTML markup it contained, including <script>...</script>, was
interpreted.

The documentation is difficult to follow, but indications are that the
formater functions (at least formatResult and formatSelection), if
overriden have to do their own escaping of data as necessary. They are
however passed the current global 'escapeMarkup' function as their
final parameter.