fix(api): escape XML in Twilio webhook responses

[Shreya-nipunge]

🛑 STOP: Assignment & File Scope Check

• I am assigned to this issue.
• I verified that this PR ONLY touches the required files.

Warning

PRs with unrelated files will not be reviewed and may be closed.

📋 PR Summary & Link

• Closes Twilio webhook XML response interpolates reply message without escaping #4252
• Summary: Escape XML-sensitive characters in the Twilio webhook replyMessage before interpolating it into the TwiML response. Added a reusable escapeXml helper and regression coverage to prevent malformed TwiML/XML injection.

📸 Proof of Work (Screenshots / Logs)

Important

No Pull Request will be merged without proof of testing!

• Frontend/UI changes: You MUST attach screenshots or screen recordings (GIFs/Videos) showing the UI changes.

Backend-only change — no UI changes or screenshots are applicable.

Test results:

npx jest --config jest.config.js tests/notifications.test.ts --forceExit --silent
PASS — 49 passed, 49 total

npx jest --config jest.config.js tests/twilioWebhookSignature.test.ts --forceExit --silent
PASS — 7 passed, 7 total

git diff --check
PASS — no whitespace errors

The regression coverage verifies:

• STOP webhook returns valid TwiML structure.
• START webhook returns valid TwiML structure.
• Default webhook response returns valid TwiML structure.
• &, <, >, ", and ' are XML-escaped correctly.
• XML injection payloads cannot break out of the <Message> element.

🏷️ PR Type

• 🐛 type: bug
• ✨ type: feature
• 📖 type: docs
• 🧪 type: testing
• 🔒 type: security
• ⚡ type: performance
• 🎨 type: design
• ♻️ type: refactor
• 🛠️ type: devops
• ♿ type: accessibility

✅ Checklist

• My PR has a linked issue (Closes #4252)
• I have pulled the latest main and resolved any conflicts

[sonarqubecloud]

Quality Gate failed

Failed conditions
B Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE