Escape reflected XSS image src input at level 1

[r1kka6]

Summary

• quote the Level 1 src attribute before rendering attacker-controlled input
• HTML-escape reflected image paths so quote characters cannot break out into event handler attributes
• keep benign image paths rendering unchanged

Verification

• ./gradlew compileJava test spotlessJavaCheck bootJar --no-daemon passed in an eclipse-temurin:17-jdk container
• vulnerable baseline returns <img src=x onerror=alert(1) width="400" height="300"/> for src=x onerror=alert(1)
• patched runtime returns <img src="x onerror=alert(1)" width="400" height="300"/> and escapes quote breakout payloads as "