Fix CodeQL security findings and exclude third-party code

[mniedermaier]

Summary

• Fix 36 CodeQL alerts in our own code (stack trace exposure, path injection, ReDoS, clear text logging)
• Exclude OpenPLC_v3 third-party code from CodeQL scanning (32 alerts in upstream code)
• Document 2 intentional findings (webshell command exec, MITM bind-all-interfaces)

Changes

Fix	Alerts	Files
Stack trace exposure → generic error messages	31	app.py, network_routes.py, cybicsagent/app.py
Path injection → safe_join + path validation	2	app.py
Polynomial ReDoS → bounded regex	1	cybicsagent/app.py
Clear text password logging → masked output	2	test_opcua_auth.py
Exclude OpenPLC_v3 from scanning	32	codeql-config.yml
Intentional: documented with comments	2	app.py, mitm.py
Total	70

Test plan

• Verify landing page still works (error responses now show generic messages)
• Verify training content file serving still works (path validation added)
• Verify CodeQL workflow runs with new config and OpenPLC alerts are excluded
• Verify cybicsagent chat functionality not affected by regex change

🤖 Generated with Claude Code