fix: escape user-controlled values rendered as raw backend HTML (stored XSS)

[gharlan]

Several places concatenated database/filesystem values into backend HTML without rex_escape(), leading to stored XSS. Most of these flows are invisible to the Psalm taint analysis because they cross dynamic-dispatch boundaries (extension-point handlers invoked via call_user_func, a fragment var set with escaping disabled, and a rex_list 'custom' column formatter which is not auto-escaped), so the static taint graph is severed between source and sink.

Fixed sinks:

• media_manager: the MEDIA_IS_IN_USE handler rendered the effect type name unescaped.
• mediapool: the MEDIA_IS_IN_USE warning rendered the referencing article name unescaped.
• metainfo: the MEDIA_IS_IN_USE handler rendered article, category, media filename and clang names unescaped.
• mediapool sync page: on-disk filenames were rendered unescaped in the writable/not-writable lists.
• media_manager effects list: the 'custom' column formatter returned the raw effect short name from the DB when the effect class is no longer registered.
• phpmailer checkmail page: the SMTP server debug output and ErrorInfo were rendered unescaped (rex_escape applied before nl2br so line breaks are preserved).

All affected values are now passed through rex_escape() before being embedded into HTML.