v0.3.1 — security: sanitise geolocation display data

Security fix. Reported by @ryanrhughes during the plugin marketplace review.

city and country come from a third-party IP geolocation response, and QML's Text defaults to Text.AutoText, which renders markup-shaped input as rich text. Qt rich text honours <img src="..."> and will load local and remote resources from inside the shell process — so a hostile or intercepted response could have put a remote image reference on the bar and had it fetched unattended on the next auto-relocate.

This release sanitises those fields at the source and strips markup-significant characters before they reach a display surface.

This fix was incomplete — see v0.3.2, which fixes the render site itself. Upgrade past this version.