fix: sanitize logged values in AreaPolygonService to prevent log forging

Replace logging of the user-influenced Position object with explicit
numeric X/Y/Z coordinates and a sanitized task id. This addresses
CodeQL alert cs/log-forging (CWE-117) where untrusted input from the
custom mission endpoint could flow into log entries and forge new
lines.

Also make Sanitize.SanitizeUserInput null-safe by accepting a nullable
string and returning string.Empty for null input rather than throwing
NullReferenceException, removing a sharp edge for current and future
callers.

Closes #123 (code-scanning alert)

Author: Christdej

backend/api/Services/AreaPolygonService.cs

@@ -1,4 +1,5 @@
 using Api.Database.Models;
+using Api.Utilities;
 
 namespace Api.Services
 {
@@ -40,9 +41,11 @@ public bool MissionTasksAreInsideAreaPolygon(
                 )
                 {
                     logger.LogWarning(
-                        "Robot position {robotPosition} is outside the inspection area polygon for task {taskId}",
-                        robotPosition,
-                        missionTask.Id
+                        "Robot position (X={X}, Y={Y}, Z={Z}) is outside the inspection area polygon for task {taskId}",
+                        robotPosition.X,
+                        robotPosition.Y,
+                        robotPosition.Z,
+                        Sanitize.SanitizeUserInput(missionTask.Id)
                     );
                     return false;
                 }

backend/api/Utilities/SanitizeInput.cs

@@ -5,9 +5,9 @@ namespace Api.Utilities
 {
     public static class Sanitize
     {
-        public static string SanitizeUserInput(string inputString)
+        public static string SanitizeUserInput(string? inputString)
         {
-            return inputString.Replace("\n", "").Replace("\r", "");
+            return inputString?.Replace("\n", "").Replace("\r", "") ?? string.Empty;
         }
 
         public static ScheduleMissionQuery SanitizeUserInput(ScheduleMissionQuery inputQuery)