Harden reporters against formula injection and invalid JSON / input shape (fixes #2299)

[jdymitarai]

Summary

This pull request resolves the three defense-in-depth hardening notes reported in #2299 across the C++ core reporters and the Python tooling:

1. Neutralize CSV Formula-Prefix Injection (CSVReporter):

   • In internal::CsvEscape, if a field value starts with a formula trigger character (=, +, -, or @), neutralize it by prepending a single-quote (') inside the quoted field (e.g. "=CMD" becomes "'=CMD").
   • Properly escape embedded double quotes (") as "".
   • Ensure user counter names printed in the CSV header row are escaped through CsvEscape.
   • Numeric columns (iterations, real_time, cpu_time) remain unquoted raw numbers, avoiding unwanted string coercion.

2. Full C0 Control Character Escaping (JSONReporter):

   • Strictly conforms to RFC 8259 Section 7, which mandates that all control characters in the range U+0000 through U+001F must be escaped.
   • internal::JsonStrEscape now escapes any byte < 0x20 as \u00XX (e.g. ANSI escape \x1b -> \u001b, NUL -> \u0000), preventing strict JSON parsers from rejecting benchmark JSON artifacts containing terminal color codes in skip/error messages.
   • Preserves standard two-character escapes (\b, \f, \n, \r, \t, \", \\) and passes UTF-8 multi-byte sequences through unchanged.

3. Input Shape and Type Diagnostics (tools/gbench/util.py):

   • Added check_benchmark_results(results, fname) to validate root object shape, context, benchmarks list, run names, numeric time values, and valid time_unit values ({"ns", "us", "ms", "s"}).
   • Provides clear, actionable error messages instead of cryptic Python tracebacks (e.g. TypeError, KeyError) when loading corrupted or malformed benchmark output artifacts.

---

Verification & Tests

• Unit tests added:
  • test/string_util_gtest.cc: Added tests for CsvEscape (formula triggers =+-@, embedded quotes) and JsonStrEscape (full C0 range 0x00..0x1F, ANSI escapes, UTF-8 strings). Passed 22/22 tests.
  • test/reporter_list_gtest.cc: Added tests for CSV formula escaping and JSON C0 escaping. Passed 7/7 tests.
  • tools/gbench/util.py: Added TestCheckBenchmarkResults covering 9 validation failure and success scenarios.
• Test suites executed:
  • test/string_util_gtest.exe: PASSED (22 tests)
  • test/reporter_list_gtest.exe: PASSED (7 tests)
  • test/reporter_output_test.exe: PASSED (full end-to-end reporter suite)
  • python -m unittest discover -s tools -p "*.py": PASSED (38 tests)

---

AI Usage Disclosure

Per AGENTS.md guidelines:

• An AI assistant (Google Antigravity) was used as an advanced IDE/development aid to assist in locating symbols, running local tests, and formatting diffs.
• The human author reviewed, verified, executed all tests locally, and takes full responsibility for this contribution.

Fixes #2299.