fix: add file-based cache busting for JavaScript and stylesheet assets

[anonymoususer72041]

This PR replaces the previous legacy asset anti-cache handling for JavaScript and stylesheet files with centralized file-based cache busting.

The change was motivated by stale browser-cached assets causing outdated client-side code to run against newer server-side code. In practice, this can produce misleading regressions that appear to be application bugs but disappear after a forced reload.

During investigation, issues such as #735, #739 and #740 were found to be affected by this class of problem. In those cases, stale JavaScript assets could cause AJAX requests to behave differently from the current server-side code, which made current master appear broken until the browser cache was bypassed. This PR addresses that underlying asset versioning problem so updated JavaScript and stylesheet files are fetched reliably after changes.

[anonymoususer72041]

I was not able to test this change in a fully reliable way before opening the PR.

Additional testing would be appreciated, especially around shared page headers, direct asset includes and pages with non-standard layouts.

[RussH]

I'll check this out locally and test

[RussH]

Thanks — the asset cache-busting change looks useful, and I do not see a PHP 7.2 compatibility issue in that part.

The main thing I’d ask for before merge is to make the activity notes rendering consistent. These two files are using the safer escaped pattern:

• modules/companies/Show.tpl
• modules/contacts/Show.tpl

They now do:

nl2br(htmlspecialchars($activityData['notes'], ENT_QUOTES | ENT_SUBSTITUTE, HTML_ENCODING))

That is ideal, the note text is escaped first and only then converted to <br> for display.

But these other paths are still using nl2br() on raw notes without escaping first:

• ajax/getPipelineDetails.php
• modules/activity/Search.tpl
• modules/activity/dataGrids.php
• modules/candidates/Show.tpl

So at the moment the PR leaves note output handled in two different ways, and these files are still vulnerable to XSS exploit if notes contains HTML or script content.

Could those be aligned so all note rendering uses the same escaped pattern before nl2br()?

Finally - this PR seems broader than the title suggests, since it also includes the Status Change activity type/schema change and some unrelated cleanup. Splitting those out would make the cache-busting change much easier to review and would keep the PR's aligned.

[anonymoususer72041]

I think you mixed things up with #733, #737 and #745, @RussH.

Regarding activity notes, I will create a new PR.

[RussH]

Thanks — I’ve rechecked this and I think my earlier comment was mixed up with other PRs. Looking at the current diff, I don’t see any issues.