Fix(Core): harden report data handling and prevent cross-entity expos…

[stonebuzz]

…ure (#381)

Backport of PR #381 from main: escape chart labels/links via json_encode() to prevent stored XSS, cast state filter values to int before SQL interpolation, validate f_name against an allow-list before building the PNG export path, and remove the logs activity report (instance-wide counts with no entity restriction).

Checklist before requesting a review

Please delete options that are not relevant.

• I have performed a self-review of my code.
• I have added tests (when available) that prove my fix is effective or that my feature works.
• I have updated the CHANGELOG with a short functional description of the fix or new feature.
• This change requires a documentation update.

Description

backport for #381

• Escape chart labels before injecting them into report graphs
• Cast state filter values before building SQL
• Remove Logs distribution report to prevent cross-entity data display

Screenshots (if appropriate):