Escape `customer_details` on lead creation from appointment

Unescaped customer_details field on appointment-to-lead creation could inject script.