fix: isolate cache poisoning level 1 banners

[tobymoreno]

Summary

• include the banner value in the Level 1 shared-cache key
• HTML-escape reflected banner content before rendering
• prevent attacker banners and stored XSS payloads from replaying to plain requests
• update regression coverage for cache misses, key separation, and escaping

Validation

• ./gradlew test --tests org.sasanlabs.service.vulnerability.cachePoisoning.CachePoisoningVulnerabilityTest
• ./gradlew spotlessCheck test
• git diff --check