[web] prevent OT CLI command injection via newline characters

[alimezar]

User-controlled strings (pskd, prefix, networkKey, pskc) from the web interface are passed into OpenThreadClient::Execute(), which builds newline-framed commands for the OT daemon Unix socket. A raw CR or LF byte in any of these fields terminates the current command and starts a new one, allowing arbitrary OT CLI command injection.

Fix both the sink and the callers:

1. In OpenThreadClient::Execute(), reject any formatted command payload that contains an embedded CR or LF byte before the framing newlines are added. This is the primary defense at the transport boundary.

2. In escapeOtCliEscapable(), stop passing through raw CR and LF bytes after the backslash prefix. Instead, strip them from the output entirely. Continue escaping spaces, tabs, and backslashes as before.

3. Apply escapeOtCliEscapable() to all user-controlled string parameters (pskd, prefix, networkKey, pskc) as defense in depth, matching the existing treatment of networkName.

[gemini-code-assist]

Code Review

This pull request enhances security against command injection in the OpenThread CLI by adding a check for line breaks in OpenThreadClient::Execute. Additionally, it ensures that various network parameters such as PSKD, prefix, network key, and PSKC are properly escaped using escapeOtCliEscapable before being passed to CLI commands. The escapeOtCliEscapable function was also updated to ignore carriage returns and newlines. I have no feedback to provide.