Firing Range: Fix all Remote Inclusion and Reflected XSS results

We run ZAP against Google Firing Range (FR) using a scheduled task and publish the results on https://www.zaproxy.org/docs/scans/firingrange/

There are currently:

• 1 Reflected XSS failure
• 2 Remote Inclusion XSS failures

It is important to note that the priority here is to improve the ZAP scan results against real work apps so any improvements should be generic rather than tailored for FR.

For more information about improving scan rules see https://www.zaproxy.org/docs/contribute/scan-rules/
In this case the relevant scan rule is linked to from each test.
As always all PRs should include full unit tests.

It is possible that some of the FR tests are no longer valid due to browser security improvements. If you believe this to be the case then please let us know and we will do our best to confirm that.

Start with the Google Firing Range scan results and the relevant scan-rule links associated with each failing test, using the scan-rules contribution guide as context. Determine whether the Reflected XSS and Remote Inclusion failures are valid, improve the rules generically rather than for Firing Range, and include full unit tests. Done means the failures are resolved or their invalidity is confirmed.