security: eliminate critical unsafe JSON quoting alerts

[EndlessSeeker]

Summary

• replace hand-built OpenAI deny JSON and SSE templates with typed payloads serialized by encoding/json
• add malicious-content regression coverage for legacy and structured, streaming and non-streaming responses
• remove the unreferenced and non-buildable internal/standalone duplicate that contained the remaining Critical finding, and correct the Makefile directory help
• upgrade CodeQL Action from v2 to v4 and scan pushes to main, pull requests targeting main, and the existing weekly schedule

Security impact

This change addresses all five currently open Critical go/unsafe-quoting CodeQL findings. Four findings are fixed by removing string interpolation from OpenAI-compatible JSON responses. The fifth was in an unreachable duplicate package that had never been buildable because its required types were absent; the executable imports the maintained standalone package instead.

No alert is dismissed or marked as accepted risk. After merge and a default-branch CodeQL scan, the expected Critical count is zero.

Validation

• go test ./... in plugins/wasm-go/extensions/ai-security-guard
• go test ./... in plugins/golang-filter/mcp-server/servers/higress/nginx-migration
• git diff --check

The AI Security Guard suite includes a new regression test proving that quotes, backslashes, newlines, and JSON-shaped attacker input remain string data and cannot add fields to the response.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 88.40580% with 8 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@c8b8279). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
...m-go/extensions/ai-security-guard/config/config.go	88.40%	4 Missing and 4 partials ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4186   +/-   ##
=======================================
  Coverage        ?   53.53%           
=======================================
  Files           ?      103           
  Lines           ?    16174           
  Branches        ?        0           
=======================================
  Hits            ?     8659           
  Misses          ?     6909           
  Partials        ?      606           

Flag	Coverage Δ
wasm-go-plugin-ai-security-guard	66.61% <88.40%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...m-go/extensions/ai-security-guard/config/config.go	87.55% <88.40%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.