Potential fix for code scanning alert no. 1: Reflected cross-site scripting

[aramprice]

Potential fix for https://github.com/cloudfoundry/go-fetcher/security/code-scanning/1

Use contextual escaping for all untrusted values inserted into HTML attributes before writing them to the response. In Go, the safest minimal fix here is to apply html.EscapeString(...) to dynamic values used inside the content="..." attribute of meta tags.

In handlers/handler.go:

• Add the standard library import html.
• In GetMeta, escape:
  • goImportContent before embedding in goImport.
  • goSourceContent before embedding in goSource.
  • h.config.ImportPrefix and repoPath before embedding in the refresh meta tag URL.
    This preserves existing behavior while preventing attribute/context breaking and reflected XSS.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[aramprice]

GitHub workers are currently having issues, which is causing the PR checks to timeout:
=> https://www.githubstatus.com/