fix: escape untrusted TLS diagnostic text

[ryanfowler]

Summary

• escape terminal controls and bidi controls in remote TLS diagnostic text
• sanitize certificate display names, DNS SANs, and negotiated ALPN output through one renderer helper
• test malicious CN, SAN, and ALPN values

Checks

• cargo fmt --check
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo test --locked --all-features --lib --bins
• cargo test --locked --all-features tls::inspect::tests