Potential fix for code scanning alert no. 10: Incomplete multi-character sanitization

[aamoghS]

Potential fix for https://github.com/DataScience-GT/query/security/code-scanning/10

In general, the best fix is to stop relying on ad‑hoc regular expressions for HTML/script sanitization and use a vetted library designed for XSS prevention. This eliminates the multi‑character sanitization pitfall and a large class of bypasses. For a Node/TypeScript backend, sanitize-html is a common, well‑maintained choice that already handles <script> tags, dangerous attributes, URIs, and malformed markup.

Concretely, within sanitizeInput’s string branch (lines 39–57), we should:

1. Import sanitize-html at the top of the file.
2. Replace the do { ... } while block that chains .replace(...) calls with a single call to sanitizeHtml, possibly configured to be reasonably strict (e.g., a default or minimal allowlist).
3. Preserve the existing trimming and length limiting behavior (trim() and slice(0, 10000)), to avoid changing downstream behavior beyond security hardening.

We will only modify code inside packages/api/src/middleware/security.ts:

• Add an import for sanitize-html.
• Replace lines 40–52 with a call to sanitizeHtml(String(input)) and then trim/slice the result as before.
  No other behavior (arrays, objects, validators, rate limiting) will be changed.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.