[daveernstingFR]

Five tools interpolated caller-supplied values directly into CREST
_queryFilter string literals without escaping, so a crafted value could
alter the query: getOidcApp, updateOidcApp, deleteOidcApp,
getTheme, and queryESVs.

This adds a shared escapeCrestStringLiteral helper
(src/utils/crestHelpers.ts) — escapes backslashes, then quotes — and
applies it at all five sites. queryESVs previously escaped quotes only;
it now uses the shared helper. getTheme escapes its value once into a
local variable reused by both clauses of its filter.

Tool schemas, descriptions, and annotations are unchanged. Tools that
accept a caller-written filter expression by design (listOidcApps,
queryManagedObjects, queryLogs) are intentionally unchanged.

Tests

• Helper unit suite (test/utils/crestHelpers.test.ts): escape cases,
  round-trip through the CREST single-pass decode, and regression guards
  (one input backslash emits exactly two; escape-once contract documented).
• Per-tool request-construction tests assert the escaped filter in the
  lookup URL for quote and backslash inputs.
• The existing getTheme quote-escape assertion is updated to require the
  escaped form.

Test plan

• Single canonical escape helper with round-trip unit tests — Verified by Polaris QA
• All five sites use the helper — Verified by Polaris QA
• Injection values yield escaped, literal-only filters (per tool) — Verified by Polaris QA
• Backslash inputs round-trip safely — Verified by Polaris QA
• getTheme escapes exactly once (no double-escaping) — Verified by Polaris QA
• queryESVs local escape replaced by the shared helper — Verified by Polaris QA
• getTheme test asserts the escaped form — Verified by Polaris QA
• Tool schemas unchanged (snapshots pass without regeneration) — Verified by Polaris QA
• Caller-written-filter tools untouched — Verified by Polaris QA
• Lint, typecheck, tests, format all pass — Verified by Polaris QA
• Commit messages describe fix and tests, no Jira actions taken — Verified by Polaris QA

🤖 Generated with Claude Code