Remediate reachable critical batch: command injection, SSRF/TLS, secret exposure, PII leakage, and x/text CVE

[Copilot]

This PR addresses the selected reachable security batch (13 units) across AI/CVE/CWE/DLP/secret families in production handlers, including upgrading golang.org/x/text from a vulnerable version and hardening multiple request-to-sink paths.

• Dependency remediation (CVE)

  • Upgraded golang.org/x/text from v0.3.7 to v0.3.8 in go.mod/go.sum.

• Command execution hardening (CWE-78 / taint-to-exec)

  • DiagnosticPing now validates host and executes ping with fixed argv (exec.Command("ping", "-c", "1", host)), removing shell invocation.
  • Replaced client-facing command error output with generic errors; internal failures are logged server-side.

• Outbound fetch controls (CWE-918 / CWE-319 / error disclosure)

  • FetchTool now enforces URL parsing, https scheme, hostname validation, and allowlisted destinations.
  • Outbound request target is mapped to fixed trusted URLs per allowed host.
  • Internal fetch/staging errors are logged; client responses are generic.

• AI endpoint data-flow hardening (AI family + error disclosure)

  • Added bounded input validation for question/task.
  • Removed raw decoder/internal error strings from HTTP responses.
  • Isolated model instructions from untrusted content and sent sanitized summaries for untrusted payloads.

• PII and secret exposure remediation (DLP + secret)

  • Removed raw sensitive values from logs and analytics payload in SupportExport.
  • Removed committed GitHub PAT constant from source.
  • CloudTokens no longer returns credential material from env; it returns only configuration state (configured / not-configured).

Example of the command-injection remediation pattern now used:

host := r.URL.Query().Get("host")
if !safety.AllowedHostname(host) {
	http.Error(w, "invalid host", http.StatusBadRequest)
	return
}

out, err := exec.Command("ping", "-c", "1", host).CombinedOutput()
if err != nil {
	log.Printf("diagnostic ping failed for host %q: %v", host, err)
	http.Error(w, "diagnostic ping failed", http.StatusBadGateway)
	return
}