fix(example): HTML-escape interpolated values in the before/ migration app

[nandan-bhat]

Summary

The before/ app in the migration-express-openid-connect example interpolated user-controlled values straight into HTML sent with res.send(...), which serves text/html. This change wraps those values in an escapeHtml() helper so a value like a display name containing <script> is rendered as text instead of running in the visitor's browser.

Why

The security review of the migration feature flagged reflected XSS in the example apps. The after/ app was already fixed in #63, but the sibling before/ app was missed and still rendered claims unescaped. Example apps are copied into real projects, so the unsafe pattern should not ship even in a demo.

Changes

• Added an escapeHtml() helper that escapes the five significant HTML characters (&, <, >, ", '), ampersand first. It mirrors the helper already in the after/ app.
• Escaped the three attacker-controllable interpolations:
  • the logged-in display name (user.name ?? user.sub)
  • the raw claim object on / (JSON.stringify(user, ...))
  • the raw claim object on /private (JSON.stringify(req.oidc.user, ...))

Values that are not attacker-controlled are left as is, matching how #63 scoped the after/ fix: the expiresAt ISO date, the AUDIENCE operator config, and the yes/no token-presence flags.

Testing

• tsc --noEmit on the before/ tsconfig passes.
• No runtime or library code changes. This touches the example app only.