Harden VulnerableApp challenge endpoints (CTF remediation batch)

[latinengineer]

Summary

• Apply root-cause remediations across major VulnerableApp challenge modules so insecure levels follow existing secure patterns
• Cover SQL injection (error/blind/union), reflected + persistent XSS, path traversal, command injection, SSRF, XXE, LDAP injection, IDOR, open redirect, clickjacking, authentication SQLi/logging, and RFI
• Update AuthLoginService unit test for the repository-backed Level 1 auth path

Areas patched

• Error / Blind / Union SQL injection — parameterized queries
• Reflected XSS (img + HTML tag) and Persistent XSS — HTML escaping / allowlists
• Path traversal L1–L12 — exact allowlisted filenames
• Command injection L1–L5 — IP/localhost validation
• SSRF L1–L4 — gist URL allowlist
• XXE L1–L2 — disallow DOCTYPE / external entities
• LDAP injection — Filter.encodeValue
• IDOR L1–L4 — ownership + ignore client-supplied role cookies
• Open redirect L1–L7, L9–L10 — whitelist
• Clickjacking vulnerable levels — CSP frame-ancestors none
• Auth L1 SQLi + L2 password logging
• Remote file inclusion — stop arbitrary remote fetches

Test plan

• CTF score Action on this PR records challenge passes
• Legitimate allowlisted/valid inputs still succeed where applicable