v0.25.2 — Security fixes

Supersedes v0.25.1 (removed — see below).

Fixes

Two findings from an earlier adversarial review, previously documented as
known, low-impact, not-currently-exploitable risks, are now fixed rather
than just accepted (ahead of a Moodle Plugins directory submission):

• html_sanitizer::clean_attributes()'s `javascript:` filter now strips
  tab/newline/CR from a url before checking it, closing a known
  browser-parsing bypass technique.
• `session_manager::create_request()` now rejects any `returnurl`
  containing a `..` path segment, closing a same-site-only open-redirect
  quirk.

Maturity bumped from alpha to beta.

See CHANGELOG.md for full details and the 0.25.0 feature list this release is built on.

Installation

Download `moodle-local_remotesupport-0.25.2.zip`, extract it, and place
the resulting `remotesupport` folder at `local/remotesupport` inside your
Moodle `dirroot`. Then visit the site administration notifications page
as an admin to complete installation. See README.md
for details.