test: add fast-check properties for CSV escaping

[Viccodes11]

Closes #1322

This PR adds rigorous property-based testing to the CSV export functionality to prevent formula injection vulnerabilities and verify correct RFC 4180 escaping.

Acceptance Criteria Mapped

• Round-trip through an RFC 4180 parser preserves content: The custom unescapeCsvField helper correctly reverses the quoting and doubling. We assert that the unescaped content completely matches the original (modulo the safe ' prefix for formulas).
• No escaped field starts with =, +, -, @, tab or CR: Fuzzed payloads enforce this constraint via expect(escaped).not.toMatch(/^[=+\-@\t\r]/).
• Fields containing quotes and newlines are wrapped and doubled correctly: The fast-check test guarantees that if delimiters exist in the original payload, the escaped result is strictly wrapped in double quotes.
• Property runs in under 2 seconds: Guaranteed by explicitly setting { interruptAfterTimeLimit: 1900 } on the fast-check assert configurations.

Security and Failure-Mode Handling

This test verifies the defenses against CSV Injection (Formula Injection). The fuzzing properties exhaustively test strings containing structural delimiters (quotes, commas, newlines) alongside dangerous formula trigger prefixes (=, +, -, @, \t, \r). It proves that our escaping strategy prevents payload evaluation—by unconditionally prepending a single quote (') to dangerous values, spreadsheet applications will securely treat the cell as raw text rather than an executable command or formula, neutralizing DDE (Dynamic Data Exchange) and related attacks.

[drips-wave]

@Viccodes11 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits