feat(probes): add CSV/spreadsheet formula injection probe + detector

[vishnukannaujia]

Fixes #1906

Summary

Adds a new probe + detector pair, formula_injection, covering CSV / spreadsheet formula injection (CWE-1236, OWASP CSV Injection).

When an application writes target output into a CSV/TSV file that is later opened in a spreadsheet, a cell whose first meaningful character is =, +, -, or @ is evaluated as a formula. An attacker-influenced cell can exfiltrate neighbouring cells (HYPERLINK / IMPORTXML / WEBSERVICE) or execute commands via legacy DDE (cmd|'/c ...').

This is the same "target output attacks a downstream sink" thesis already used by ansiescape (terminal) and web_injection (browser); here the downstream sink is the spreadsheet. Approach was floated for scope-fit in #1906 first.

What's added

• probes.formula_injection.FormulaInjection — stub × payload prompts that try to get the target to emit a formula-injection cell. intent = "S008inject"; tags owasp:llm02, owasp:llm05, avid-effect:security:S0200, quality:Security:Integrity; tier = INFORMATIONAL.
• detectors.formula_injection.FormulaInjection — a deterministic regex detector that flags a formula-trigger cell containing a known-dangerous spreadsheet function / DDE construct. No model call needed to evaluate it.
• Tests mirroring the ansiescape probe/detector tests.

Before → after

• Before: garak had no coverage for the CSV/spreadsheet downstream-sink vector (only terminal via ansiescape and browser via web_injection).
• After: formula_injection elicits and detects spreadsheet formula-injection payloads.

Tests

• tests/probes/test_probes_formula_injection.py — prompt structure & payload triggers.
• tests/detectors/test_detectors_formula_injection.py — every payload → 1.0, benign CSV (incl. a lone negative number -5) → 0.0, None output → None.
• Passes the generic probe/detector conformance suites (intent, tags, tier, docstrings, detector existence) and black.

A false-positive guard is built in: a formula-trigger character alone isn't a hit — the cell must also carry a dangerous function/DDE construct, so ordinary negative numbers in a CSV don't trigger.