Sanitize user input before sending it to ldap

Editor assessment

This commit patches CVE-2026-39962. The subject, fix: sanitize user input before sending it to ldap, is a clean imperative sentence that correctly describes the mitigation, and it is short enough to read at a glance. It is also the entire message: no scope, no body, and no footer, so the specific injection point, the escaping function applied, and any test coverage are left to the diff. The companion commit for the same CVE carries far more detail, which highlights how little this one records on its own. Understandable but barely instructive.