Tweak: Added more escaping

[KingYes]

✨ PR Description

1. Problem & Context

Security hardening pass to enforce output escaping and input sanitization across the plugin, elevating EscapeOutput violations from warnings to CI failures.

2. What Changed (Where)

File	Change
aryo-activity-log.php	Removed notification include; wrapped error messages in esc_html()
class-aal-activity-log-list-table.php	Added esc_attr(), esc_html() to printf outputs, removed array-building pattern
class-aal-admin-ui.php	Escaped page title (esc_html_x()), sanitized $_REQUEST['page']
class-aal-api.php	Sanitized $_SERVER IP address access with sanitize_text_field()
class-aal-maintenance.php	Escaped wp_die() message with esc_html__()
class-aal-settings.php	Escaped form outputs, removed notification UI code, escaped admin notices
ruleset.xml	Made WordPress.Security.EscapeOutput an error; warnings remain for other Security rules
bin/install-wp-tests.sh, .github/workflows/	Improved download resilience with retry logic

3. How It Works

Output escaping now applied at echo/printf points using context-aware functions (esc_html() for text, esc_attr() for attributes, esc_url() for URLs). User input sanitized at entry (sanitize_text_field(), sanitize_key()). Ruleset enforces via CI—EscapeOutput failures block merge, other Security sniffs remain warnings pending debt resolution.

4. Risks

Low. Changes are additive escaping with no logic alterations. Download retry logic may mask transient failures if too aggressive. Settings page removed notifications tab UI without confirming feature deprecation—verify no legacy configs depend on that tab visibility.

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Description using Guidelines Learn how}