Escape control characters in more terminal output

[fnando]

What

Sanitizes three more attacker-influenceable strings before they reach the terminal, so control and ANSI escape sequences can no longer survive to a user's screen:

• contract arg parsing — UDT struct field names are embedded into the clap value_name shown in --help; the value name is now run through sanitize().
• contract upload — the SDK version read from contract metadata (used in an error/warning line, including the release-candidate check) is now sanitized while still preserving rc detection.
• events — the event id, event_type, ledger_closed_at, and decoded contract_id are now sanitized before being written to stdout.

Each change comes with a test that feeds embedded escape sequences (e.g. \x1b[2J, \x1b[H) and asserts no control characters survive in the rendered output.

Why

Contract spec/metadata and RPC event data are not trusted input. Rendering them verbatim lets a malicious contract inject terminal escape sequences (screen clears, cursor moves, color resets) into CLI output. This continues the terminal-output sanitization sweep started in recent commits, closing the remaining unescaped paths in --help value names, upload warnings, and event listings.

Known limitations

N/A

[Copilot]

Pull request overview

Sanitizes attacker-influenced contract metadata and RPC event fields before terminal rendering.

Changes:

• Sanitizes event identifiers, metadata, and contract IDs.
• Sanitizes SDK version metadata used in upload diagnostics.
• Sanitizes generated clap value names and adds unit regressions.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
commands/events.rs	Sanitizes event output fields.
contract/upload.rs	Sanitizes SDK version diagnostics.
contract/arg_parsing.rs	Sanitizes help value names.