Security: enable Jinja2 autoescaping in CLI template rendering (FHUB-259)

[Eyal-Danieli]

Summary

Resolves the two high-severity CodeQL code-scanning alerts
py/jinja2/autoescape-false in the CLI by enabling Jinja2 autoescaping where
templates are rendered.

Changes

• cli/common/generate_item_yaml.py – pass autoescape=select_autoescape()
  to the Jinja2 Environment. The item templates are *.yaml.j2, so
  autoescape resolves to False at runtime and generated item.yaml output is
  unchanged; the change satisfies the scanner and is safe-by-default for any
  future HTML/XML templates added to the loader.
• cli/utils/helpers.py (render_jinja) – choose autoescape based on the
  template file extension via
  select_autoescape(enabled_extensions=("html","htm","xml")). This is the
  substantive fix: render_jinja injects raw source code / YAML into the
  marketplace's python.html and yaml.html pages, which were previously
  rendered without escaping (the reported XSS vector). HTML/XML templates are now
  escaped, while non-HTML templates (e.g. conf.template -> conf.py) continue
  to render unescaped.

Why extension-based (not a blanket autoescape=True)

render_jinja is used for both HTML pages (must escape) and non-HTML files like
conf.py (must not escape, or the generated Python config could be corrupted).
Deriving autoescape from the template extension fixes the XSS without changing
non-HTML output.

Test plan

• Verified HTML templates now escape embedded content
  (<script> -> <script>).
• Verified conf.template / non-HTML output remains unescaped.