sec(api): newline in account fields can break out of comment lines in federation deploy scripts #970

Found while reviewing #963 (which fixes #958).

Problem

shellEscape (internal/api/handler_federation.go:398) escapes \ " $for double-quoted bash contexts, but it does not handle a newline. Several federation templates put fields on#` comment lines. A newline in one of those values would end the comment, and the rest of the value would run as a command when the admin runs the generated script.

Fields on comment lines in internal/iacfiles/templates/:

• aws-cfn-deploy.sh.tmpl:3-4,9: AccountName, AccountExternalID, Source
• aws-cross-account-cfn-deploy.sh.tmpl:3, aws-cross-account-cli.sh.tmpl:3,7,9, aws-wif-cli.sh.tmpl:3-9, azure-wif-cli.sh.tmpl:3,6,12
• *.tfvars.tmpl comment lines. These are rendered with unescaped data, so a newline would let a value inject HCL.

validateCloudAccountRequest (internal/api/handler_accounts.go:351) only requires name to be non-empty, so an account name containing \n appears to be accepted. This has not been verified end to end. To do: confirm that AccountName in the federation bundle comes from the stored account name, and check AccountSlug/Source.

Not affected

The bicep/arm deploy-azure.sh after #963. Its only fields are the contact email, where mail.ParseAddress rejects CR/LF, and the API URL from trusted config, and both sit in double-quoted contexts. AccountName is empty on that path.

Suggested fix

Do one or both:

• Reject control characters (at least CR/LF) in account name and external_id at the write paths.
• Make the template renderer strip or replace newlines in values on comment lines, or move those values out of comments.

Add a test that renders each shell and tfvars template with a value containing \n plus a marker command, then checks the output with bash -n and that the marker never runs. #963's sandboxed bash pattern can be reused for this.