ROCK-8362: Sanitize CustomSchedule

[jwakefield-secc]

Summary

• FormatScheduleDates() method added to PublishGroup.cs — converts RDATE-based schedules into readable text (e.g., "Tuesdays at 6:30 PM: Aug 5, Aug 19, Sep 2...") instead of storing raw iCal or HTML
• Replaced FriendlyScheduleText (returns HTML for specific-date schedules) and iCalendarContent (raw iCal) references with FormatScheduleDates across all code paths that populate CustomSchedule
• Save sanitization — .SanitizeHtml() applied on save to strip any HTML that might leak through the textbox
• Lava defense-in-depth — | StripHtml filter added to SECC2019 and SECC2024 GroupFinder templates
• NullReferenceException fix — OnInit now guards publishGroup and publishGroup.Group before accessing GroupTypeId

Test Link: https://sedev.secc.org/page/2006?PublishGroupId=9044

Files Changed

File	Changes
Plugins/org.secc.GroupManager/Model/PublishGroup.cs	FormatScheduleDates() method, ScheduleText getter sanitization
Plugins/org.secc.GroupManager/org_secc/GroupManager/PublishGroupRequest.ascx.cs	Lines 206, 269, 407 (display), 494 (save), OnInit null fix
Plugins/org.secc.Themes/Themes/SECC2019/Assets/Lava/Groups/GroupFinder.lava	`
Plugins/org.secc.Themes/Themes/SECC2024/Assets/Lava/Groups/GroupFinder.lava	`

Test Plan

• Open a publish group with an RDATE schedule (specific dates) — Custom Schedule should show "Tuesdays at 6:30 PM: Aug 5, Aug 19..." instead of iCal or HTML
• Open a publish group with a weekly schedule — Custom Schedule should show normal friendly text
• Open a new publish group request (no existing record) — page should not throw NullReferenceException
• Save a publish group and verify CustomSchedule is stored as clean plain text
• Check group finder page renders schedule text without HTML tags
• Verify existing iCal records get cleaned up when the publish group page is opened and saved