fix: sanitize dynamic completion values

[Finesssee]

Motivation

• Dynamic completion output previously emitted untrusted API/cache names verbatim, which could include shell metacharacters and enable command-injection when used by shell completion (e.g., compgen/substitution).

Description

• Add a new sanitize_completion_value function that trims control whitespace and allowlists safe characters for insertion into shell completions.
• Use sanitize_completion_value for the completion "value" field emitted for teams, projects, issues, statuses, users, and labels, while keeping description sanitization intact.
• Add two unit tests validating that shell metacharacters are stripped and common identifier formats (e.g., LIN-123, emails, slashes) are preserved.

Testing

• Ran cargo test test_sanitize_completion_value -- --nocapture and the new tests passed.
• Ran cargo fmt to format changes successfully.

---

Codex Task

[Finesssee]

This change is already on master as c91cbd5 () and shipped in v0.3.19, so I’m closing this PR as already landed.

[Finesssee]

Closing because this exact change is already on master in c91cbd5 and released in v0.3.19.