Feature request: Function to sanitize messages and avoid XSS

If a request/response contains a malicious script, it would be nice to have a function that automatically sanitizes the string.

Doing it manually, e.g. replacing
`$util.toJson($ctx.result)`
with
`$util.toJson($util.str.toReplace($ctx.result, "script", ""))`
has the risk of inconsistencies and missing exploits.

A sanitize function could look like this instead:
`$util.toJson($util.str.sanitizeHtml($ctx.result))`

The issue names the $util.toJson, $util.str.toReplace, and proposed $util.str.sanitizeHtml entry points, but no implementation files or tests. First locate the existing string utility definitions and the project's testing approach, then establish which malicious-script cases must be covered. Done means the proposed utility consistently sanitizes request or response strings without requiring manual replacements.

Written by the indexing model from the issue text.