fix(sms): sanitize incoming SMS display values

[xkg38]

Description

Incoming SMS bodies and sender values are remotely controlled and are stored in the Message and Sender commands. These string values may later be rendered by Jeedom widgets using innerHTML, allowing unescaped markup to be interpreted in the session of the user displaying the widget.

This change applies secureXSS() before logging or storing these display values. The original SMS body remains unchanged for askResponse() and interaction matching, so existing SMS interaction behavior is preserved.

Suggested changelog entry

Sanitize incoming SMS message and sender values before storing and displaying them.

Related issues/external references

No related public issue.

Types of changes

• Bug fix (non-breaking change which fixes)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
  • This change is only breaking for integrators, not for external standards or end-users.
• Documentation improvement

PR checklist

• I have checked there is no other PR open for the same change.
• I have read the [La ligne directrice pour contribuer à ce projet / Contribution guidelines for this project).
• I grant the project the right to include and distribute the code under the GNU.
• I have added tests to cover my changes.
• I have verified that the code complies with the projects coding standards.
• [Required for new sniffs] I have added MD documentation for the sniff.