Add escape_html() function to prevent HTML injection in Telegram
parse_mode=HTML messages. Apply escaping to event titles inserted
into <a> tags in send_to_telegram().
- Add escape_html() using stdlib html.escape()
- Escape match event titles (line 648) and non-match titles (line 676)
- Add TestHtmlInjection with 2 tests proving fix:
- <script> tags escaped as <script>
- & ampersands escaped as &
- Fixes HIGH severity: titles from Polymarket API were inserted
without escaping, allowing malformed HTML in Telegram messages
d0534aedbf