op_contains in Views fulltext filter doesn't escapeLike() user input

Problem/Motivation

Fulltext.php
Lines 134-139

  public function op_contains($fulltext_field) {
    $value = mb_strtolower($this->value[0]);
    $value = str_replace(' ', '%', $value);
    $placeholder = $this->placeholder();
    $this->query->addWhereExpression($this->options['group'], "$fulltext_field LIKE $placeholder", [$placeholder => '% ' . $value . '%']);
  }

The value is parameter-bound, so no SQL injection. But the sibling op_word() escapes with $this->connection->escapeLike(...) before adding wildcards, and op_contains() doesn't — so literal %/_ typed by the user behave as SQL LIKE wildcards, broadening results beyond what the UI suggests.

Steps to reproduce

Proposed resolution

Call escapeLike() first, then do the space-to-% conversion.

Remaining tasks

User interface changes

API changes

Data model changes