Escape changed file names in code-path notification emails

[theinfosecguy]

Summary

• Escape changed file names before inserting them into HTML email content in send-notification-on-change.js.
• Escape other interpolated values in the generated email body and stop logging raw HTML payloads.
• Add explicit pull-requests: read permission in code-path-changes.yml for least-privilege API access clarity.
• Skip notification execution when mail OAuth secrets are not configured so the workflow exits cleanly instead of failing all PRs.

Testing Done

• Reviewed escaping paths for all interpolated HTML fields.
• Verified secret-missing path exits successfully in script and workflow gating.
• CI run validation in upstream repository by maintainers.

[ChrisCarini]

LGTM! Consider contributing this upstream, too!