Security: Neutralize formulas in CSV exports - refs GHSA-8279-8m4m-g6g4

[christianbeeznest]

Fixes GHSA-8279-8m4m-g6g4 for master.

• Prevent CSV formula injection across user, survey, exercise, gradebook, and reporting exports.
• Neutralize dangerous formula prefixes without modifying stored data.
• Add regression tests for CSV formula escaping.

Validation:

• PHP lint passed for all 23 files.
• PHPUnit: 4 tests passed, 23 assertions.
• Real user CSV export verified in Chamilo 3.1.
• Git diff and pre-push checks passed.

Survey export testing remains pending.

Refs GHSA-8279-8m4m-g6g4

[codecov]

Codecov Report

❌ Patch coverage is 49.23077% with 33 lines in your changes missing coverage. Please review.
✅ Project coverage is 15.60%. Comparing base (ce75c93) to head (f2f6b73).
⚠️ Report is 2 commits behind head on master.

Files with missing lines	Patch %	Lines
...undle/Controller/Admin/UsergroupListController.php	0.00%	3 Missing ⚠️
...Controller/Api/AdminStatisticsExportController.php	0.00%	3 Missing ⚠️
...oller/Api/CourseReportingLearnersCsvController.php	0.00%	3 Missing ⚠️
...ler/Api/CourseReportingSectionExportController.php	0.00%	3 Missing ⚠️
...Controller/Api/GlobalReportingExportController.php	0.00%	3 Missing ⚠️
src/CoreBundle/Framework/Exporter.php	0.00%	3 Missing ⚠️
...e/Controller/Admin/UsergroupAddUsersController.php	0.00%	2 Missing ⚠️
...er/Api/ExercisePendingAttemptsExportController.php	0.00%	2 Missing ⚠️
src/CoreBundle/Helpers/CsvFormulaEscaper.php	94.11%	2 Missing ⚠️
...ce/Exercise/ExerciseRuntimeReportExportService.php	0.00%	2 Missing ⚠️
... and 6 more

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #9267      +/-   ##
============================================
+ Coverage     15.59%   15.60%   +0.01%     
- Complexity    62009    62024      +15     
============================================
  Files          2514     2515       +1     
  Lines        232829   232866      +37     
============================================
+ Hits          36303    36335      +32     
- Misses       196526   196531       +5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.