fix(security): defense-in-depth hardening for plugin_audit

[somethingwithproof]

Summary

Defense-in-depth hardening addressing 7 security audit findings.

• XSS: Escape request variables in HTML output with html_escape_request_var()
• SQLi: Convert string-concat queries to prepared statements
• Deserialization: Add allowed_classes => false to unserialize()

All changes PHP 7.0+ compatible.

Test plan

• PHP lint clean
• Pre-push review PASS (Claude + Grok + Copilot)
• Verify plugin functionality

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Pull request overview

Defense-in-depth hardening for the Cacti audit plugin, focused on reducing attack surface (XSS mitigation in UI output) and adding repository-level security automation (CodeQL + Dependabot).

Changes:

• Escape the page request variable before rendering it into an HTML hidden input.
• Add a CodeQL workflow for JavaScript/TypeScript analysis.
• Add a Dependabot configuration for GitHub Actions (and npm).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
audit.php	Escapes a request variable before embedding it into HTML output.
.github/workflows/codeql.yml	Introduces CodeQL scanning workflow (JS/TS matrix).
.github/dependabot.yml	Enables Dependabot updates for GitHub Actions and npm.

[somethingwithproof]

Converted to draft to serialize the stack in this repo. Blocked by #51; will un-draft after that merges to avoid cross-PR merge conflicts.

[somethingwithproof]

Closing as superseded after rebasing against current develop. The advertised XSS, prepared-statement, and safe-unserialize changes are already present in develop; the remaining PR diff is unrelated CodeQL/locale churn, so there is no in-scope change left to merge.