Strip control characters from contract read output

[fnando]

What

Sanitizes the key/value fields in stellar contract read's default (--output string) output so control and escape sequences can no longer reach the terminal unescaped. The per-entry record building is extracted into a small entry_record helper and the String branch now wraps soroban_spec_tools::to_string with soroban_spec_tools::sanitize. A regression test covers a top-level ScVal::Symbol carrying escape bytes.

Why

soroban_spec_tools::to_string returns raw, unescaped bytes for a top-level ScVal::Symbol, and the default output writes those straight to the terminal via the CSV writer. Every other output mode (JSON/XDR) already escapes its content, and the auth-entry signing prompt was hardened the same way in #2667. This applies the same defense-in-depth to the contract read display path so untrusted ledger content cannot smuggle terminal escape sequences into a user's terminal.

Known limitations

N/A

[Copilot]

Pull request overview

Sanitizes contract read string output to prevent terminal control-sequence injection.

Changes:

• Extracts ledger-entry formatting into entry_record.
• Sanitizes string-formatted keys and values.
• Adds a unit regression test for malicious symbols.