Neutralize CSV formulas and escape control characters in logged strings (#931)

* Neutralize CSV formulas and escape control characters in logged strings

CSV fields starting with =, +, -, @, tab, or CR get a leading apostrophe
(OWASP CSV Injection, CWE-1236). Sender-controlled subject/From and a few
aggregate-parser values are passed through the new sanitize_for_log()
before they reach error messages and logs.

Closes #929

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Sanitize more sender-controlled log values; fix sanitize_for_log docs

Escape the SMTP TLS policy-type in its error and org_name/report_id in the
duplicate-report debug lines, correct the sanitize_for_log docstring, and
drop the unreachable return in parse_report_email().

Closes #929

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Test the From-header escaping with a raw control character

mail-parser 4.8.0, which CI resolves, no longer decodes an RFC 2047
encoded word in the From header (4.6.2 did), so the previous test saw the
encoded word rather than the CR LF it was meant to observe. A raw ESC in
the display name survives both versions.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

docs/source/usage.md

@@ -136,6 +136,10 @@ The full set of configuration options is:
       results to STDOUT (Default: `True`)
   - `output` - str: Directory to place JSON and CSV files in. The JSON
       and CSV filename options below only take effect when this is set.
+      CSV cells that begin with `=`, `+`, `-`, `@`, a tab, or a
+      carriage return are written with a leading apostrophe (`'`), so
+      spreadsheet applications treat them as text rather than formulas
+      ([CSV injection](https://owasp.org/www-community/attacks/CSV_Injection)).
   - `archive_directory` - str: Optional. When set, successfully
       processed report files given as local file/directory path
       arguments are moved into