fix: sanitize parser sandbox error messages to prevent sensitive data leaks

[ionfwsrijan]

Description

The ParserSandboxError exception includes captured stderr output (up to 2000 chars) in its message, which propagates through the call stack into task.error_message in the database and ultimately to the API response. Additionally, _BOOTSTRAP_TEMPLATE.format() uses user-influenced parser_path which can cause format-string injection.

Changes

1. backend/secuscan/parser_sandbox.py:ParserSandboxError — Apply redact() to the stderr excerpt and reduce limit from 2000 to 500 chars. This ensures secrets in parser diagnostic output are sanitized before they reach the API layer.
2. backend/secuscan/parser_sandbox.py:_BOOTSTRAP_TEMPLATE — Replace str.format() with str.replace() using sentinel markers (__MAX_INPUT_BYTES__, __PARSER_PATH_REPR__) to prevent format-string injection via user-influenced parser_path.
3. backend/secuscan/executor.py:execute_task() — Apply redact() to str(e) before storing as error_message in the general exception handler.
4. backend/secuscan/executor.py:_parse_results() — Apply redact() to the error message in the generic exception handler.
5. backend/secuscan/parser_sandbox.py — Updated module docstring with security notes about stderr sensitivity.

Impact

• Secrets in parser stderr output are redacted before reaching the API response
• Format-string injection via plugin file paths is eliminated
• Error messages stored in the database are sanitized
• Diagnostic stderr is still captured for logging but sanitized before user-facing exposure

Files Changed

• backend/secuscan/parser_sandbox.py — ParserSandboxError sanitization, template injection fix, docstring update
• backend/secuscan/executor.py — redact() applied in exception handlers

Closes #1626

[ionfwsrijan]

@utksh1 Please review this. The failing check is pre-exisiting

[utksh1]

The parser-sandbox error sanitization is good, but backend-unit CI is failing and the branch has merge conflicts. Please rebase on latest main, fix the failing tests, and push again.

[ionfwsrijan]

@utksh1 Please review this now

[utksh1]

The updated error message now appends sanitized stderr to the user-facing exception. Redaction is not a guarantee that parser stderr is safe to disclose, and the prior design deliberately kept diagnostics private. Please retain redaction for logs/diagnostics but do not include stderr excerpts in API-facing errors; add a regression test proving secret-like and arbitrary parser output are not exposed.

[ionfwsrijan]

@utksh1 Please review this now