Potential fix for code scanning alert no. 2: Email content injection

[ziembor]

Potential fix for https://github.com/ziembor/gomailtesttool/security/code-scanning/2

General fix: sanitize/normalize untrusted email fields at request handling time before placing them into config, so downstream SMTP writing only receives pre-sanitized content. This is the best single fix because it addresses both alert variants at the trust boundary (r.Body flow), preserves existing behavior, and complements existing sanitization in buildEmailMessage.

Best concrete change:

• In internal/serve/smtp_handler.go, add local sanitization helpers for subject/body.
• Apply them when assigning cfg.Subject and cfg.Body (lines around current 64–65 in provided snippet).
• Use existing strings package functions (add strings import) to:
  • strip CR/LF from subject to avoid header-shaping behavior and normalize whitespace;
  • normalize body newlines and remove unsafe control chars except \n and \t.

No external dependency is required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.