fix: Implement comprehensive CSV injection security protection

[coderolisa]

closes #1034

• Add formula injection validation on CSV import to reject malicious rows
• Add sanitization on all CSV exports (backend and client)
• Protect against cells starting with =, +, -, @, tab, or carriage return
• Dangerous cells are prefixed with single quote to force text interpretation

Changes:

• csv-import-service.ts: Added detectFormulaInjection() and validateCellSafety()
• renewal-history.service.ts: Added sanitizeCSVCell() for export protection
• privacy-metrics.ts: Added sanitizeCSVCell() for export protection
• csv-utils.ts: Enhanced with security comments and sanitization
• Added comprehensive test suites for import and export security

Tests:

• csv-import-service.test.ts: 50+ test cases for import validation
• renewal-history-csv-export.test.ts: Export sanitization tests
• privacy-metrics-csv-export.test.ts: Privacy metrics export tests
• csv-utils.test.ts: Client-side protection tests

Security:

• Prevents DDE (Dynamic Data Exchange) attacks
• Prevents hyperlink injection and data exfiltration
• Prevents command execution via formula injection
• Defense-in-depth: protection at both import and export layers

Documentation:

• CSV_INJECTION_SECURITY_FIX.md: Comprehensive security documentation

Resolves CSV injection vulnerability issue

Description

---

Test Plan

• Tested locally
• Verified expected behavior
• No regressions introduced

---

Screenshots (if applicable)

---

Checklist

• Code builds successfully
• Tests pass
• Follows project conventions
• No sensitive data exposed

[drips-wave]

@coderolisa Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits