security: fix XSS in GraphTimelineExporter SVG innerHTML rendering

Vertex IDs were interpolated directly into SVG innerHTML via template
literals in the client-side draw() function without HTML escaping.
A vertex name containing '<script>' or event handler attributes
(e.g. '<img onerror=alert(1)>') would execute arbitrary JavaScript
when the timeline HTML file was opened in a browser.

Added escH() HTML-entity encoder and applied it to node ID strings
in both <title> tooltips and <text> labels before innerHTML insertion.

Author: sauravbhattacharya001

Gvisual/src/gvisual/GraphTimelineExporter.java

@@ -354,15 +354,17 @@ private String getJS() {
             + "    const c = EDGE_COLORS[l.type] || EDGE_COLORS.unknown;\n"
             + "    html += `<line x1='${s.x}' y1='${s.y}' x2='${t.x}' y2='${t.y}' stroke='${c}' stroke-width='1.5' stroke-opacity='0.6'/>`;\n"
             + "  });\n"
+            + "  function escH(s){return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/\"/g,'&quot;').replace(/'/g,'&#39;');}\n"
             + "  // Nodes\n"
             + "  nodes.forEach(n => {\n"
             + "    const r = Math.max(4, Math.min(16, 3 + n.degree));\n"
             + "    const cls = n.isNew ? 'node-enter' : '';\n"
             + "    const fill = n.isNew ? '#45e980' : '#e0e0e0';\n"
+            + "    const safeId = escH(n.id);\n"
             + "    html += `<circle cx='${n.x}' cy='${n.y}' r='${r}' fill='${fill}' class='${cls}' stroke='#333' stroke-width='1'>`;\n"
-            + "    html += `<title>${n.id} (degree: ${n.degree})</title></circle>`;\n"
+            + "    html += `<title>${safeId} (degree: ${n.degree})</title></circle>`;\n"
             + "    if (nodes.length < 40) {\n"
-            + "      html += `<text x='${n.x}' y='${n.y - r - 3}' text-anchor='middle' font-size='10' fill='#aaa'>${n.id}</text>`;\n"
+            + "      html += `<text x='${n.x}' y='${n.y - r - 3}' text-anchor='middle' font-size='10' fill='#aaa'>${safeId}</text>`;\n"
             + "    }\n"
             + "  });\n"
             + "  svg.innerHTML = html;\n"