Sec/security hardening

[FUjr]

Summary

This PR hardens QModem command execution and SMS rendering paths against injection and XSS-style risks.

Changes

• Quote modem AT/SMS command arguments in shell scripts.
• Harden qmodem_sms ucode RPC command execution:
  • validate config section, device paths, PDU, SIM index, and SMS storage values
  • quote shell arguments before popen() / system()
  • stop returning unused internal SMS config/raw SIM payload fields
• Harden legacy LuCI SMS controller command execution.
• Harden legacy LuCI/QModem Lua command execution paths:
  • add action allowlist for modem_ctrl
  • quote dynamic shell arguments
  • replace unsafe sysfs echo > path with file writes
  • replace several io.popen("ls ...") directory listings with nixio.fs.dir()
• Render SMS/PDU data as text instead of HTML in legacy and shared SMS UI helpers.

Validation

• sh -n passed for modified shell scripts.
• node --check passed for sms-pdu.js.
• git diff --check passed for the security commits.
• Static scan confirmed targeted SMS UI files no longer use innerHTML.

Notes

Lua and ucode syntax checks were not run locally because lua, luac, and ucode are not installed in this environment.