Fix log forging vulnerability (CodeQL alert #1) in GraderFunction.cs

[Copilot]

CodeQL flagged alert #1 (cs/log-forging) in GraderFunctionApp/GraderFunction.cs: the user-controlled trace query parameter was written directly into log messages, allowing an attacker to inject \r/\n sequences and forge fake log entries.

Changes

• Sanitize trace before logging by stripping carriage return and newline characters, while keeping the original value intact for ExtractEmail.

string trace = req.Query["trace"];
var email = ExtractEmail(trace);
string sanitizedTrace = trace?.Replace("\r", "").Replace("\n", "");
log.LogInformation("start:" + sanitizedTrace);
xml = await RunUnitTestProcess(context, log, credentials, email, filter);
log.LogInformation("end:" + sanitizedTrace);

Verification

• Re-ran CodeQL analysis after the fix: 0 alerts remaining.
• Alert Initial commit. #1 was confirmed a genuine issue (not a false positive) — no other alerts were in scope for this change.