Security: Neutralize formulas in CSV exports - refs GHSA-8279-8m4m-g6g4

[christianbeeznest]

Fixes GHSA-8279-8m4m-g6g4 for the 1.11.x branch.

• Prevent CSV formula injection in the legacy CSV export helper.
• Protect user exports, survey reports, MySpace reports, and import error exports.
• Neutralize dangerous spreadsheet formula prefixes without modifying stored data.
• Add regression tests for CSV formula escaping.

Validation:

• PHP syntax checks passed for all 5 files.
• PHPUnit: 4 tests passed, 21 assertions.
• Git diff checks passed.
• Browser-based testing remains pending on a compatible 1.11.x installation.

Refs GHSA-8279-8m4m-g6g4