Fix CodeQL warning: Log entries created from user input

[pmachapman]

See: https://github.com/sillsdev/web-xforge/security/code-scanning/540

---

---

This change is 

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.

General approach: Ensure that any data that can originate from user input is normalized before being written to logs. For plain-text logs, this typically means removing or replacing control characters that can break the log format, especially \r and \n. We should also avoid changing log message structure so existing analysis still works. Since the vulnerable sink is the Log method in ParatextSyncRunner, we can centralize the fix by sanitizing both the interpolated IDs and the message written to _syncMetrics.Log.

Best concrete fix for this code:

1. Keep the existing Sanitize() calls on projectSFId and userId in the _logger.LogInformation(...) call; these already reduce risk.
2. Additionally sanitize the message parameter at the start of Log to remove newline sequences and carriage returns. Use simple string.Replace calls, as recommended, to strip Environment.NewLine, \r, and \n.
3. Use this sanitized message both for the structured logger call and when adding to _syncMetrics.Log. This ensures that any content derived from user input cannot inject extra log lines into either the normal log output or the metrics log.
4. Implement the sanitization locally in ParatextSyncRunner.Log to minimize impact on existing functionality and avoid broad changes. No new dependencies are required.

Concretely, in src/SIL.XForge.Scripture/Services/ParatextSyncRunner.cs, update Log so that:

• It normalizes message into a new variable sanitizedMessage by stripping newlines.
• It uses sanitizedMessage in _logger.LogInformation and in _syncMetrics.Log.Add(...).

No other files need edits for this specific alert, because the sink is centralized in this logging method.

---

[marksvc]

I'm a bit confused about what the github warning is about; I wonder if it is pointing out a need to sanitize message.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.33%. Comparing base (6ef8e7b) to head (c5f11b2).
⚠️ Report is 1 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3726   +/-   ##
=======================================
  Coverage   81.33%   81.33%           
=======================================
  Files         620      620           
  Lines       39037    39037           
  Branches     6364     6359    -5     
=======================================
  Hits        31749    31749           
  Misses       6304     6304           
  Partials      984      984           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[marksvc]

I'm a bit confused about what the github warning is about; I wonder if it is pointing out a need to sanitize message.