fix(webserver): add htmlspecialchars + addslashes builtins and escape remote-controlled strings in the WebUI (XSS) - #106

What

Fixes stored/reflected XSS in the amuleweb default template. Adds two
escaping builtins to the embedded PHP interpreter and uses them to escape
every echo of remote-controlled data in the right context.

Why

Several pages echoed attacker-influenced strings into HTML without escaping, so
a shared file or server named <script>…</script> (or a malicious eD2K server
name, or a remote client's reported version/OS string) executed JavaScript in
the admin's authenticated session.

The bundled mini-PHP interpreter had no escaping builtins (htmlspecialchars,
str_replace, …), and include() is unusable (it resolves against the process
cwd), so there was previously no clean way to escape from a template.

Changes (3 commits)

1. htmlspecialchars builtin (php_core_lib.cpp)

• Escapes & < > " ' (matching PHP ≥8.1 htmlspecialchars with ENT_QUOTES).
• Byte-wise into a std::string — UTF-8 safe (metacharacters are ASCII and
  never appear inside multibyte sequences), no manual buffer sizing.

2. addslashes builtin (php_core_lib.cpp)

• Escapes a string for a double-quoted JavaScript string literal inside a
  <script> block. On top of the classic \ " ' set, it escapes < as
  \x3C (so an embedded </script> cannot terminate the script element) and
  CR/LF as \r/\n.
• Every escape decodes back to the original char in JS, so a value assigned to
  a form field is displayed verbatim — unlike htmlspecialchars, whose HTML
  entities are not decoded inside a raw-text <script>.

3. Audit + escape across all .php templates

• HTML text / attribute context → htmlspecialchars: file names, user names
  (dload, shared, search), server name/desc/addr (servers), raw log/serverinfo
  (log.php), connected server name/address in the iframe status bar
  (stats.php), stats-tree leaf labels (stats_tree.php), category names in
  <option> lists (dload, search, footer).
• JS-string context → addslashes: the nickname (settable via ?nick=) and
  option values emitted into the <script> initvals block in prefs.php.
• Updated an obsolete comment in amuleweb-main-search.php (the sort param
  stays whitelisted — stricter than escaping for that reflected value).

Testing

• amuleweb builds clean (no new warnings).
• Built the standalone interpreter under AddressSanitizer + UBSan and ran,
  for both builtins:
  • Functional/edge-case batteries (all specials, empty, non-string types,
    nested calls, UTF-8, missing/extra args).
  • 10k–100k-call loops and multi-MB worst-case inputs — no per-call leaks
    (allocation count independent of iteration count), no overflow.
  • Differential fuzz (hundreds of random byte strings) vs reference escapers —
    exact match.
  • addslashes: real-JS (node) round-trip — every payload (incl.
    </script>, quotes, backslash, newlines, unicode) decodes back to the
    original and never produces a literal </script> that closes the block.
  • All 13 templates parse and run clean; crafted payloads render inert and
    display correctly.