Address add-filter toast XSS path by sanitizing dynamic notification content

[Copilot]

The review comment identified an unsanitized HTML path in the applications add-filter flow: the success toast interpolated applicationName || instanceId directly into an HTML message. This leaves an XSS gap even though related action handlers already sanitize similar notification content.

• Scope from review comment

  • Apply the fix only to the add-filter success notification path in views/applications/index.vue.
  • Add a regression test that covers malicious filter names/instance IDs in the add-filter flow.

• Code change

  • Sanitize the constructed toast message before passing it to notificationCenter.success, matching the existing sanitization approach used in other application/instance action notifications.

• Regression coverage

  • Add/extend applications view tests to assert that injected markup (e.g. <img ... onerror=...> / <script>) is stripped in the add-filter success toast path.

notificationCenter.success(
  sanitizeHtml(
    `${t('applications.notifications_suppressed_for', {
      name: notificationFilter.applicationName || notificationFilter.instanceId,
    })} <strong>${notificationFilter.expiry.fromNow(true)}</strong>.`,
  ),
);