hardening: escape syslog output surfaces and harden host option rendering

[somethingwithproof]

Summary

This PR hardens unescaped syslog UI output paths and removes unsafe HTML string insertion for AJAX host options.

Changes

• escape host/facility/priority/program values in stats table output (syslog.php)
• escape host names rendered in device filter lists (syslog.php)
• escape report/removal confirmation list values (syslog_reports.php, syslog_removal.php)
• use escaped cell rendering for report message list column (syslog_reports.php)
• replace jQuery HTML string concatenation with DOM-safe option creation (js/functions.js)
• add regression coverage for these hardening paths
• run regression scripts from CI when tests/regression/*.php exist
• add changelog entry for issue hardening: escape device hostname output in syslog view; parameterize alert API functions #252

Validation

• php -l syslog.php
• php -l syslog_reports.php
• php -l syslog_removal.php
• php -l tests/regression/issue252_xss_output_test.php
• php tests/regression/issue252_xss_output_test.php

Fixes #252

[Copilot]

Pull request overview

This PR hardens several unescaped UI output surfaces in the Syslog plugin for Cacti, closing XSS-equivalent risks where database values (hostnames, facility/priority names, filter patterns) were rendered into HTML without escaping.

Changes:

• Wrap database-sourced values (host, facility, priority, program) with html_escape() in stats table cells and filter <option> elements in syslog.php
• Escape confirmation dialog list items in syslog_reports.php and syslog_removal.php using html_escape(), and switch the report message column from form_selectable_cell to form_selectable_ecell for automatic escaping
• Replace jQuery HTML string concatenation with DOM-safe $('<option>').val().text().addClass() construction in js/functions.js to eliminate unescaped hostname injection via AJAX host autocomplete

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
syslog.php	Adds html_escape() around four <td> stat cells and three <option> lists (host, facility, priority)
syslog_reports.php	Escapes confirmation list item; switches report message table cell to form_selectable_ecell
syslog_removal.php	Escapes confirmation list item
js/functions.js	Replaces unsafe HTML concatenation for AJAX-loaded <option> elements with jQuery DOM API methods