[Epic] Sanitization Feature — log injection, path traversal, sensitive-data & regex-injection prevention

[marioarce]

Summary

Introduce a new Pluggable Feature family, PowerCSharp.Feature.Sanitization, providing
production-hardened string sanitization for four concerns:

• Log injection prevention (CWE-117) — control-character stripping/encoding with configurable strategy
• File path traversal prevention (CWE-22) — allowlist validation + legacy pattern-stripping mode
• Sensitive data masking (CWE-200) — pattern-based detection/masking of tokens, secrets, URLs, paths
• Regex injection / ReDoS prevention (CWE-400/730) — pattern complexity scoring and safety validation

This is a ground-up reimplementation of a proven, previously-shipped sanitization engine, adapted to
PowerCSharp's architecture and fully de-branded from its origin.

Package layout

• PowerCSharp.Feature.Sanitization.Abstractions (netstandard2.0;net8.0, no third-party deps) —
  the static sanitization engine, extension methods (SanitizeForLog, SanitizeForFilePath,
  SanitizeForSensitiveData, SanitizeForRegexInjection), result records, enums, and settings model.
  Usable standalone by any consumer, no ASP.NET Core dependency required.
• PowerCSharp.Feature.Sanitization (net8.0) — IFeatureModule + FeatureOptionsBase options bound
  from PowerFeatures:Sanitization, DI-registered ISanitizationService, explicit
  AddSanitizationFeature() extension. Runtime-flag gated per the Features Framework two-layer model.

Why a new Pluggable Feature family (not Built-in, not a plain Helper)

Per Workflows.md SOP-02, a feature with non-trivial implementation is always Pluggable (Group 2),
never PowerCSharp.BuiltInFeatures — the engine has ReDoS complexity scoring, allowlist path
validation, and multi-strategy encoding, well past "lightweight." A plain Helper/Utility was rejected
because we want runtime on/off toggling and startup diagnostics visibility via the Features Framework.

Versioning

New version family: PowerCSharpFeatureSanitizationVersion, starting at 1.0.0, added to
Directory.Build.props and the package_family choices in .github/workflows/ci-cd.yml.

Acceptance Criteria

• Both packages build for their target frameworks (Release)
• Full test coverage for engine logic + module flag-on/flag-off behavior
• READMEs + docs/PowerCSharp.Feature.Sanitization.md + root README table entry
• CHANGELOG.md entry under [Unreleased]
• Zero mentions of the source project this was migrated from, anywhere in code/docs/commits

Child Issues

• Scaffold PowerCSharp.Feature.Sanitization.Abstractions
• Scaffold PowerCSharp.Feature.Sanitization (module)
• Wire into solution, Directory.Build.props, CI/CD
• Test coverage for the Sanitization feature
• Documentation: READMEs, docs page, CHANGELOG