[Mo3he]

Fixes the 3 open CodeQL js/xss-through-dom alerts and the wider issue behind them.

Problem: an imported rule (backup, shared template) keeps its own id, and per-field values such as port or scenario_id are not type-checked server-side. Those values were inserted into HTML unescaped, so a crafted rule file could run script in the admin's browser:

• in the rules list (rule id inside onclick="editRule('...')"), on page load;
• in the rule editor (~70 numeric/ID fields, plus scenario IDs and PTZ channels from local/remote devices).

Fix:

• Every data-derived value now goes through escHtml(); fixed labels are unchanged.
• JS handler arguments use new escJsArg() (JSON-quoted, then HTML-escaped).
• escHtml() also escapes '.
• settings.js: removed a stray escHtml on a textContent assignment (showed &).
• Cache-busters bumped for the changed scripts.

Tested on camera 155 (P3288-LV, OS 12.11):

• Imported a booby-trapped rule (payload in id, trigger port, action seconds): rules list and editor render it as text, no script ran, nothing injected.
• All 56 trigger/condition/action forms render with zero JS errors, incl. 21 remote-device variants.
• Edit+save of existing rules leaves them unchanged; values with " ' & < > \\ round-trip byte-identical.
• Camera restored to signed 1.9.16 with rules/settings identical to the pre-test backup.