Clean the file URI in log lines, as the other uploader-controlled values are

Problem/Motivation

The module's log lines name the file they are about by its URI, and part of that URI is the file name the uploader chose. Every other value an outsider controls in these lines is already passed through LogText::printable(), which replaces control characters, bidirectional overrides and line separators with ?: the digitalSourceType, the reason a read failed, and the file name in the warning about scaled uploads. The file URI is the one value left.

Measured: a file whose name contains U+202E (right-to-left override) appears in the dblog line with the override intact, so the line reads differently from what it contains. dblog escapes the value for HTML, so this is not markup injection; it is a log line that can misrepresent itself, and a U+2028 or NEL can split it in a syslog consumer.

The URI reaches the log in two places: the {file} placeholder in CredentialSuggester (nine log calls), and the {reason} of an item whose file cannot be read from disk, logged by the CredentialRead queue worker.

Proposed resolution

Pass the URI through LogText::printable() in both places. A test scans CredentialSuggester's source so that a log line added later cannot pass the raw URI. An ordinary URI, with spaces and accents, is logged unchanged.

Not in this issue: the characters printable() keeps on purpose, such as the zero-width joiner, which emoji and several scripts need.

Remaining tasks

• Tests, then the fix.