Escape reflected XSS HTML tag input at level 1

[r1kka6]

Summary

• HTML-escape Level 1 reflected values before placing them inside the response <div>
• close the generated wrapper with </div> so the returned markup stays well-formed
• keep benign text rendering unchanged while preventing script-tag interpretation

Verification

• ./gradlew compileJava test spotlessJavaCheck bootJar --no-daemon passed in an eclipse-temurin:17-jdk container
• vulnerable baseline returns <div><script>alert(1)</script><div> for q=<script>alert(1)</script>
• patched runtime returns <div>&lt;script&gt;alert(1)&lt;/script&gt;</div> and still returns <div>hello world</div> for benign text