Escape import collaboration filename values

[moksha-hub]

Summary

• render filename/session values with the correct Jinja escaping for HTML and JavaScript contexts
• move filename usage in inline scripts to a tojson-encoded variable instead of raw template interpolation
• escape the filename before inserting it into dynamically generated input HTML and URL-encode it for /runas

Verification

• issue [Security][Critical] Stored XSS via Unsanitized Filename Injected into JavaScript Context in importcollabload.html #41 is currently unassigned and has no closing PR references
• git diff --check origin/main HEAD
• verified branch diff contains only Website/templates/importcollabload.html

Fixes #41