Deprecation warning fixed

Implements the highest-signal deferred findings surfaced by Pass 1:

examples/ — security fixes copied by users (CWE-798, CWE-79, CWE-22):
- basic_authentication.cpp: read BASIC_USER/BASIC_PASS from env; bail
  if unset; capture into the lambda. Removes hardcoded "myuser"/"mypass".
- digest_authentication.cpp: read DIGEST_PASS from env; bail if unset.
- file_upload.cpp: add html_escape() helper and escape every
  user-controlled field (key, filename, fs path, content-type, transfer
  encoding) before writing into the HTML table.
- file_upload_with_callback.cpp: html_escape() the filename in the HTML
  body and add is_safe_filename() guard (rejects empty/./../slash/
  backslash/NUL) before joining with permanent_dir.

test/REGRESSION.md §4 — prose drift:
- The pinned overlap test now asserts `*hp == first` (deterministic
  first-wins) but the prose still said "could be either one". Updated
  to match the actual assertion and remove the v1-era hedge.

Closes task-040 #58 #59 #60 #61 and task-028 #9 #25 in the unworked
review issues tracker.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>