fix(mail): escape rich object links and skip unsendable digest users

[solracsf]

Three unrelated faults in the mail path, all in the same area.

Unescaped link. The link of a rich object went straight into the href while the link text beside it was escaped. A parameter carrying a quote closes the attribute and injects markup into the mail body:

link: https://example.com/"><script>alert(1)</script>
-> Shared <a href="https://example.com/"><script>alert(1)</script>">secret.txt</a>

Providers are server-side so nothing reachable today puts user input there, but escaping the text and trusting the URL is the kind of asymmetry a future provider walks into.

Broken timezone aborted the whole run. new DateTimeZone() sat outside the per-user try/catch, so one unparseable core/timezone preference threw out of the loop and nobody after that user got a digest. Every hour, silently. The verdict is memoised so a shared bad value is logged once rather than once per user.

Users without an address. Not skipped, so the entire digest was built and handed to the mailer only for it to throw into the catch-all, once per user per run. The last-sent marker still advances so adding an address later doesn't flood them with backlog.

Verified on Nextcloud 36 against MariaDB 11.4, PostgreSQL 16 and S3 primary storage. The three behavioural tests fail on the current code.