Fix Xss in name field of custom reports

[aryaantony92]

Changes in this pull request

Resolves #

Additional info

WHAT

🤖 Generated by Copilot at d6a57ca

This pull request fixes a XSS vulnerability in the custom report feature of the AdminBundle. It adds validation for the custom report name in the CustomReportController class and encodes/decodes the name in the panel.js file.

🤖 Generated by Copilot at d6a57ca

CustomReportController is the gatekeeper of the name
No XSS can pass through its validation flame
deleteField must encode and decode with care
Or the panel.js will unleash the XSS nightmare

HOW

🤖 Generated by Copilot at d6a57ca

• Add validation checks for custom report name to prevent XSS vulnerability (link, link, link)
• Extract validation logic to a helper method isValidConfigName in CustomReportController.php to avoid code duplication and improve readability (link)
• Encode and decode custom report name when deleting a field in panel.js to prevent XSS vulnerability (link)

[github-actions]

Review Checklist

• Target branch (10.5 for bug fixes, others 11.x)
• Bug fix: check if files are affected that were moved to a bundle - create a PR there if applicable
• Tests (if it's testable code, there should be a test for it - get help)
• Docs (every functionality needs to be documented, see here)
• Migration incl. install.sql (e.g. if the database schema changes, ...)
• Upgrade notes (deprecations, important information, migration hints, ...)
• Label
• Milestone

[martineiber]

LGTM